Repository navigation
ci: refresh popular.json inline in deploy workflow - #51
Merged
Nick Brady (nicholasdbrady) merged 5 commits intoJun 15, 2026
Merged
Nick Brady (nicholasdbrady) merged 5 commits into
Nick Brady (nicholasdbrady) merged 5 commits into
Conversation
The standalone update-popular.yml has been failing every day since 2026-05-28 because it relies on the GITHUB_TOKEN opening a pull request, which the microsoftopensource enterprise has disabled permanently (SSIRP 23011). The documented workaround is a GitHub App, but OSPO labels that 'Here be dragons' and it isn't appropriate for this low-stakes, non-blocking data refresh. Instead, fold the App Insights fetch into deploy.yml so the freshly queried data is written into the build directly. Add a daily cron trigger to deploy.yml so freshness matches the previous behaviour. If the App Insights query fails, the step is marked continue-on-error and the build falls back to the committed site/src/data/popular.json, with a workflow warning recording the miss. preview.yml is left alone so fork PRs never receive Azure credentials. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Contributor
🔍 PreviewA live preview of this PR is available at: |
Lets us exercise Azure OIDC login + scripts/fetch-popular.ts on demand without rebuilding the site or pushing to gh-pages, so we can prove the federated credential and App Insights query work before relying on deploy.yml's scheduled refresh. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
…alidation Removed before merge. workflow_dispatch isn't dispatchable on a workflow that doesn't yet exist on the default branch, so we let this PR trigger it via pull_request on relevant paths. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
The trigger surfaced an expected fed-cred mismatch (PR events use subject 'repo:.../forgebook:pull_request' which the Entra app intentionally doesn't trust). The production triggers in deploy.yml (push to main, schedule, workflow_dispatch from main) all map to the existing ref:refs/heads/main subject and will continue to authenticate. Run \gh workflow run validate-popular-fetch.yml\ from main after merge to confirm end to end before relying on the scheduled refresh. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Nick Brady (nicholasdbrady)
enabled auto-merge (squash)
June 15, 2026 18:18
Nick Brady (nicholasdbrady)
deleted the
nicholasdbrady/update-popular-use-github-app-token
branch
June 15, 2026 18:19
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Why
update-popular.ymlhas been failing every scheduled run since 2026-05-28 with:The App Insights query inside the workflow actually succeeds — only the
peter-evans/create-pull-request@v8step fails. The repo-level toggle to allow the Actions bot to open PRs is greyed out because themicrosoftopensourceenterprise disabled it permanently as part of the SSIRP 23011 mitigation.The documented workaround (using a GitHub App identity for the
create-pull-requesttoken) is explicitly flagged "Here be dragons! This is NOT recommended if you are attaching to production systems." in Microsoft OSPO's GitHub Actions Security Announcement. For a non-blocking popularity refresh, that's not the right trade.What
Fold the App Insights fetch directly into
deploy.ymlso the refreshedpopular.jsonis consumed by the build and pushed via the existing GitHub Pages deploy — no commits, no pull requests, no new identities.deploy.ymlschedule: "0 6 * * *"daily trigger so freshness matches the previous behaviour.id-token: writepermission and Azure OIDC login (mirrors whatupdate-popular.ymlused).Refresh popular notebooks data from App Insightsrunsscripts/fetch-popular.tsbeforeastro build. Markedcontinue-on-error: trueso a transient telemetry outage degrades to using the committedpopular.jsoninstead of failing the deploy.::warning::if the refresh failed, so the miss is visible in the Actions UI.update-popular.yml— deleted.validate-popular-fetch.yml— new manual-only diagnostic that runs Azure OIDC login +fetch-popular.tswithout touching the build orgh-pages. Useful for one-off validation and ongoing debugging.AGENTS.md+.github/AGENTS.md— updated CI table and the "Popular Notebooks" section to describe the new behaviour.preview.yml— intentionally unchanged. Fork PRs must not receive Azure credentials, and they're fine using the committed fallback.Verification
cd site && npm ci && npm run buildpasses locally using the committedpopular.jsonfallback path (exercising the same code path CI will hit on App Insights failure).pull_requesttrigger (now removed). It failed at the Azure login step withAADSTS700213: No matching federated identity record found for presented assertion subject 'repo:microsoft-foundry/forgebook:pull_request'— which is the correct security posture. The Entra app's federated credential is scoped toref:refs/heads/main, so:pushtomain,schedule, andworkflow_dispatchfrommainall produce the trustedref:refs/heads/mainsubject and will authenticate, exactly like the oldupdate-popular.ymldid.AZURE_CLIENT_ID,AZURE_TENANT_ID,AZURE_SUBSCRIPTION_ID, andvars.APP_INSIGHTS_RESOURCE_IDalready exist from the deleted workflow.Rollout
After merging, dispatch the diagnostic workflow from
mainonce:It will log the freshly-fetched
popular.jsonwithout touching production. Once that's green, the next push tomain(or the 06:00 UTC cron) will use the same code path insidedeploy.yml.