Repository navigation
Use ubuntu-latest and the preinstalled Azure CLI in workflows - #5275
Max Martin (maxmartin-cgi) wants to merge 7 commits into
Conversation
Move the CodeQL workflow from ubuntu-22.04 to ubuntu-latest and install the latest Azure CLI in the Lets Encrypt workflow instead of pinning 2.81.0. Refs #5273 Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
GitHub-hosted Ubuntu 24.04 and 26.04 runner images include Azure CLI 2.91.0, so the workflow no longer installs a pinned or latest package. Keep apt-get update before the certbot package install, which is the only apt install left in the job. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Unit Test Results0 tests 0 ✅ 0s ⏱️ Results for commit 868f3c5. ♻️ This comment has been updated with latest results. |
|
/test |
|
🤖 pr-bot 🤖 🏃 Running tests: https://github.com/microsoft/AzureTRE/actions/runs/39932922726 (in response to this comment from Max Martin (@maxmartin-cgi)) |
Marcus Robinson (marrobi)
left a comment
Marcus Robinson (marrobi)
left a comment
There was a problem hiding this comment.
Do we had ubuntu and az cli pinned before as we have been hit by breaking changes in az cli, and ubuntu release breaking dependencies... Can we just pin to the newer versions?
| analyze: | ||
| name: Analyze | ||
| runs-on: ubuntu-22.04 | ||
| runs-on: ubuntu-latest |
There was a problem hiding this comment.
Should we not pin? We have had issues before where it has upgraded and broken other dependencies.
There was a problem hiding this comment.
Default CodeQL workflow runs on ubuntu-latest and it seems to be working for most. We can always pin it down to version when/if we hit the issue. I worry that these pins add extra maintenance which might no longer be needed.
Default codeql workflow from github:
runs-on: ${{ (matrix.language == 'swift' && 'macos-latest') || 'ubuntu-latest' }}
Updated the Azure CLI version in the Lets Encrypt renewal workflow and changed the CodeQL workflow from ubuntu-22.04 to ubuntu-26.04.
Correct the target version for the CodeQL workflow from 'ubuntu-22.04' to 'ubuntu-latest' in the Lets Encrypt renewal workflow.
|
/test-force-approve |
|
🤖 pr-bot 🤖 ✅ Marking tests as complete (for commit 868f3c5) (in response to this comment from Max Martin (@maxmartin-cgi)) |
Resolves #5273
What is being addressed
GitHub moves the
ubuntu-latestlabel from Ubuntu 24.04 to Ubuntu 26.04. The rollout started on 19 October 2026 and ends on 19 November 2026. Two workflows need a change:lets_encrypt.ymlinstallsazure-cli="2.81.0-1~<codename>". On Ubuntu 26.04 the codename isresolute, and the Microsoft apt repository has only 2.90.0 and 2.91.0 for it, soapt-get installfails.codeql-analysis.ymlusesubuntu-22.04. GitHub retires this image on 17 April 2027, and jobs on it fail during the brownouts on 6 and 13 April 2027.How is this addressed
lets_encrypt.yml: removes the pinned Azure CLI install. The GitHub-hosted Ubuntu 24.04 and 26.04 runner images include Azure CLI 2.91.0 (per the runner-images Readme for each image), so the step now runsaz version.sudo apt-get updatemoves directly above the certbot package install, which is the only apt install left in the job.codeql-analysis.yml: moves fromubuntu-22.04toubuntu-latest.make letsencrypt, which is unchanged.Validation:
python3 -m unittest discover -s devops/tests -p "test_letsencrypt_preflight.py" -vran 5 tests, all OK. These runmake letsencryptagainst fakeazandcertbotbinaries, so they do not cover the install step.lets_encrypt.ymlitself. It is not registered on the fork, so it could not be dispatched, and no live Azure renewal was executed.