fix(workflows): harden CI workflows to fail-fast on lint, security, and doc-gen errors#393
Open
WilliamBerryiii wants to merge 5 commits intomainfrom
Open
fix(workflows): harden CI workflows to fail-fast on lint, security, and doc-gen errors#393WilliamBerryiii wants to merge 5 commits intomainfrom
WilliamBerryiii wants to merge 5 commits intomainfrom
Conversation
added 3 commits
April 12, 2026 11:01
- flip soft-fail parameters to false in PR validation and main workflows - remove redundant dependency-scan-main job from main workflow - add fail-on-critical to security-monitoring job - bump terraform-docs version to v0.20.0 🔧 - Generated by Copilot
- add terraformDocsVersion: 'v0.20.0' to docs-check-terraform-main job - matches the same pin already set in pr-validation workflow 🔧 - Generated by Copilot
📚 Documentation Health ReportGenerated on: 2026-04-14 01:12:41 UTC 📈 Documentation Statistics
🏗️ Three-Tree Architecture Status
🔍 Quality Metrics
This report is automatically generated by the Documentation Automation workflow. |
added 2 commits
April 14, 2026 13:15
- remove invalid --rcfile flag from shellcheck command in shell-lint.yml - reformat 80+ shell scripts with shfmt to match .editorconfig 2-space indent - add --disable-rule=terraform_required_providers to tflint in terraform-lint.yml 🔧 - Generated by Copilot
- remove shellcheck_output.txt (empty local debug artifact, not used by CI workflow) - remove LICENSE.txt (HashiCorp BSL license does not belong in this Microsoft repo) 🧹 - Generated by Copilot
📚 Documentation Health ReportGenerated on: 2026-04-15 01:34:25 UTC 📈 Documentation Statistics
🏗️ Three-Tree Architecture Status
🔍 Quality Metrics
This report is automatically generated by the Documentation Automation workflow. |
📚 Documentation Health ReportGenerated on: 2026-04-15 03:05:33 UTC 📈 Documentation Statistics
🏗️ Three-Tree Architecture Status
🔍 Quality Metrics
This report is automatically generated by the Documentation Automation workflow. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Description
Converts all CI soft-fail and break-build flags to hard-fail across both PR validation and main branch workflows. Removes the redundant
dependency-scan-mainjob from the main workflow, and aligns theterraformDocsVersionpin tov0.20.0in both pipelines.PR Validation (
pr-validation.yml)soft-fail: true→soft-fail: falsefor shell-lint, terraform-lint, and code-quality-lintgrype-soft-fail: true→grype-soft-fail: falsefor security-scanterraformDocsVersion: 'v0.19.0'→'v0.20.0'for docs-check-terraformMain Branch (
main.yml)break-build: false→break-build: truefor rust-clippy, docs-check-terraform, and docs-check-bicepterraformDocsVersion: 'v0.20.0'for docs-check-terraformfail-on-critical: truefor security-comprehensive (Grype/Trivy)dependency-scan-mainjob (16 lines) — redundant with 5 overlapping security layers: security-comprehensive (Grype + Trivy), security-scan (Grype in PR), CodeQL via GitHub Advanced Security, Dependabot, and GitHub secret scanningAuto-Generated Side Effects
The
terraformDocsVersionbump tov0.20.0caused minor whitespace changes in auto-generated Terraform README files (051-vm-host/terraform/README.md,modules/virtual-machine/README.md) and aCargo.lockupdate.Related Issue
Related to #374
Type of Change
Implementation Details
PR Validation Hard-Fail — Flipped
soft-failfromtruetofalsefor shell-lint, terraform-lint, and code-quality-lint reusable workflow calls. Flippedgrype-soft-failfromtruetofalsefor the security-scan job. PRs that introduce lint or security findings will now block merge.Main Branch Hard-Fail — Flipped
break-buildfromfalsetotruefor rust-clippy, docs-check-terraform, and docs-check-bicep. Addedfail-on-critical: truefor the security-comprehensive job. Main branch runs will now fail visibly on lint, doc-gen, or critical vulnerability findings.Redundant Job Removal — Deleted the
dependency-scan-mainjob that ran Grype on the main branch. This scan was fully covered by thesecurity-comprehensivejob (Grype + Trivy), plus CodeQL, Dependabot, and secret scanning provide additional layers.Version Pin Alignment — Added explicit
terraformDocsVersion: 'v0.20.0'to the main workflow's docs-check-terraform call, matching the pin already present in pr-validation.yml.Testing Performed
Validation Steps
soft-fail,break-build, andgrype-soft-failflags are consistently set to their hard-fail values across both workflows.terraformDocsVersionis pinned tov0.20.0in bothpr-validation.ymlandmain.yml.dependency-scan-mainjob is completely removed and no dangling references remain.npm run tflint-fix-allandnpm run tf-validatelocally — all pass.Checklist
terraform fmton all Terraform codeterraform validateon all Terraform codeaz bicep formaton all Bicep codeaz bicep buildto validate all Bicep codeSecurity Review
Additional Notes
terraform fmt,terraform validate,az bicep format, andaz bicep buildchecklist items are not applicable.dependency-scan-mainremoval reduces CI run time on the main branch with no loss in security coverage.Screenshots (if applicable)