[Jay W (JayDoubleu)]

Release tracking: microsoft/AzureTRE#5084

What is being addressed

AzureTRE-Deployment still installs v0.29.0. AzureTRE v0.29.1 is now available as a pre-release, and this repository's separate cleanup script still lacks its protection for active GitHub Actions runs.

How is this addressed

• Set UPSTREAM_REPO_VERSION to v0.29.1, which resolves to eed7eada06e658b4c6ebed858b5a3bc9fcec104c.
• Copy the released cleanup script into .github/scripts/clean_ci_validation_envs.sh. It defers cleanup when another workflow is active or queued and aborts when the GitHub response cannot be checked.
• Grant the cleanup job read access to workflow runs and PRs.
• Port the 15 cleanup regression tests and run them when the cleanup script, tests or relevant workflows change. Test formatting follows this repository's Flake8 defaults.
• Build the deployment devcontainer on a native amd64 GitHub runner when its files or the build workflow change. Check the installed source version, configuration file, TRE CLI and Porter without Azure credentials or network access during the runtime checks.

Behaviour	Before	After
AzureTRE source installed by the devcontainer	v0.29.0	v0.29.1
Cleanup while a deployment or test is active or queued	Environment stop/deletion can proceed	Cleanup is deferred
Cleanup when workflow status cannot be verified	No check before the environment sweep	Cleanup aborts before Azure operations
Cleanup regression coverage in this repository	None	15 mocked tests, selected by changed paths
Devcontainer build validation on PRs	None	Conditional native amd64 build and installed-release checks

Release alignment

Compared .devcontainer and .github between AzureTRE v0.29.0 and v0.29.1. Upstream devcontainer tooling is unchanged. The deployment repository retains its source-download setup, environment selection and deployment workflows.

The upstream PR bot, JavaScript helper tests and their npm dependency configuration do not exist in this repository. The new skip_deployment integration is specific to those PR bot commands. Existing deployment-specific workflows and Dependabot settings are preserved.

Validation

• All 15 cleanup tests pass locally with mocked Azure and GitHub commands.
• ShellCheck, Flake8, Bash syntax, YAML parsing and git diff --check pass.
• The cleanup script is byte-for-byte identical to the v0.29.1 release.
• Native amd64 CI validation passed on d63f504: full devcontainer build, installed v0.29.1 source version, source repository, configuration file, TRE CLI and Porter checks.
• All PR checks pass, including lint, the 15 cleanup tests, CodeQL and CLA.
• Container validation completed on GitHub's native amd64 runner. The local ARM64 emulated build could not complete Porter installation.

Azure deployment and upgrade validation through AzureTRE-Deployment remain pending. Its main deployment and reusable deployment workflows are currently manually disabled. The earlier passing AzureTRE smoke and extended E2E run is recorded in microsoft/AzureTRE#5084, but does not validate this deployment repository update.

[Copilot]

Copilot review overview

🔵 Needs a closer look

Deployment and upgrade validation for the new upstream release remains pending.

Review effort: Balanced
Findings: None

What changed in this PR

Upgrades AzureTRE deployment tooling to v0.29.1 and adds safeguards and validation for cleanup and devcontainer changes.

Changes:

• Pins AzureTRE v0.29.1.
• Defers cleanup while workflows are active or queued.
• Adds cleanup regression tests and devcontainer build validation.

File	Description
.devcontainer/​devcontainer.json	Updates the AzureTRE release pin.
.github/​scripts/​clean_ci_validation_envs.sh	Protects environments used by active workflows.
.github/​tests/​test_clean_ci_validation_envs.py	Adds mocked cleanup regression coverage.
.github/​workflows/​build_validation_develop.yml	Runs cleanup tests and conditional container validation.
.github/​workflows/​clean_validation_envs.yml	Grants required read permissions.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.