1
  2
  3
  4
  5
  6
  7
  8
  9
 10
 11
 12
 13
 14
 15
 16
 17
 18
 19
 20
 21
 22
 23
 24
 25
 26
 27
 28
 29
 30
 31
 32
 33
 34
 35
 36
 37
 38
 39
 40
 41
 42
 43
 44
 45
 46
 47
 48
 49
 50
 51
 52
 53
 54
 55
 56
 57
 58
 59
 60
 61
 62
 63
 64
 65
 66
 67
 68
 69
 70
 71
 72
 73
 74
 75
 76
 77
 78
 79
 80
 81
 82
 83
 84
 85
 86
 87
 88
 89
 90
 91
 92
 93
 94
 95
 96
 97
 98
 99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127

targetScope = 'resourceGroup'

param location string = 'australiaeast'
param automationName string = 'aa-gh-publishing'
param storageName string = 'stghpub${uniqueString(resourceGroup().id)}'
param vaultName string = 'kv-ghpub-${uniqueString(resourceGroup().id)}'
param githubAppId string = ''
param githubInstallationId string = ''
param githubKeySecretName string = 'github-app-private-key'
param alertActionGroupId string = ''

var runnerConfig = {
  subscriptionId: subscription().subscriptionId
  resourceGroup: resourceGroup().name
  storageAccount: storage.name
  stateContainer: 'cycles'
  vaultName: vault.name
  githubAppId: githubAppId
  githubInstallationId: githubInstallationId
  githubKeySecretName: githubKeySecretName
  organization: 'ExamplePublishing'
  timeZone: 'Australia/Sydney'
  alertReceiver: alertActionGroupId
  workflows: [
    {
      repository: 'blog'
      workflow: 'azure-static-web-apps-red-flower-083307e00.yml'
      ref: 'main'
      publishDays: ['Tuesday', 'Thursday']
    }
    {
      repository: 'ai-strategy-blog'
      workflow: 'azure-static-web-apps.yml'
      ref: 'main'
      publishDays: ['Wednesday', 'Friday']
    }
  ]
}

resource storage 'Microsoft.Storage/storageAccounts@2023-05-01' = {
  name: storageName
  location: location
  sku: { name: 'Standard_LRS' }
  kind: 'StorageV2'
  properties: {
    allowBlobPublicAccess: false
    allowSharedKeyAccess: false
    minimumTlsVersion: 'TLS1_2'
    supportsHttpsTrafficOnly: true
    publicNetworkAccess: 'Enabled'
  }
}
resource blobs 'Microsoft.Storage/storageAccounts/blobServices@2023-05-01' = {
  parent: storage
  name: 'default'
  properties: {}
}
resource container 'Microsoft.Storage/storageAccounts/blobServices/containers@2023-05-01' = {
  parent: blobs
  name: 'cycles'
  properties: { publicAccess: 'None' }
}
resource vault 'Microsoft.KeyVault/vaults@2023-07-01' = {
  name: vaultName
  location: location
  properties: {
    tenantId: subscription().tenantId
    sku: { family: 'A', name: 'standard' }
    enableRbacAuthorization: true
    enableSoftDelete: true
    enablePurgeProtection: true
    softDeleteRetentionInDays: 7
    publicNetworkAccess: 'Enabled'
    accessPolicies: []
  }
}
resource automation 'Microsoft.Automation/automationAccounts@2024-10-23' = {
  name: automationName
  location: location
  identity: { type: 'SystemAssigned' }
  properties: {
    sku: { name: 'Basic' }
    publicNetworkAccess: true
    disableLocalAuth: true
  }
}
resource runtime 'Microsoft.Automation/automationAccounts/runtimeEnvironments@2024-10-23' = {
  parent: automation
  name: 'PublishingPowerShell74'
  location: location
  properties: {
    runtime: { language: 'PowerShell', version: '7.4' }
    defaultPackages: {}
  }
}
resource config 'Microsoft.Automation/automationAccounts/variables@2024-10-23' = {
  parent: automation
  name: 'RunnerConfig'
  properties: { isEncrypted: false, value: string(runnerConfig) }
}
resource stateControl 'Microsoft.Authorization/roleAssignments@2022-04-01' = {
  name: guid(container.id, automation.id, 'state')
  scope: container
  properties: {
    roleDefinitionId: subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'ba92f5b4-2d11-453d-a403-e96b0029c9fe')
    principalId: automation.identity.principalId
    principalType: 'ServicePrincipal'
  }
}
resource keyRead 'Microsoft.Authorization/roleAssignments@2022-04-01' = {
  name: guid(vault.id, automation.id, 'key')
  scope: vault
  properties: {
    roleDefinitionId: subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '4633458b-17de-408a-b874-0445c86b69e6')
    principalId: automation.identity.principalId
    principalType: 'ServicePrincipal'
  }
}

output automationAccountId string = automation.id
output automationPrincipalId string = automation.identity.principalId
output stateAccountName string = storage.name
output keyVaultName string = vault.name
output runtimeEnvironmentName string = runtime.name
output configuration object = runnerConfig
// Operator publication creates/verifies schedules. Incremental deployment never deletes the old VM.
output scheduleNames array = ['SydneyDaily0030', 'PublishingRecovery0130', 'PublishingDeadline0630']

  1
  2
  3
  4
  5
  6
  7
  8
  9
 10
 11
 12
 13
 14
 15
 16
 17
 18
 19
 20
 21
 22
 23
 24
 25
 26
 27
 28
 29
 30
 31
 32
 33
 34
 35
 36
 37
 38
 39
 40
 41
 42
 43
 44
 45
 46
 47
 48
 49
 50
 51
 52
 53
 54
 55
 56
 57
 58
 59
 60
 61
 62
 63
 64
 65
 66
 67
 68
 69
 70
 71
 72
 73
 74
 75
 76
 77
 78
 79
 80
 81
 82
 83
 84
 85
 86
 87
 88
 89
 90
 91
 92
 93
 94
 95
 96
 97
 98
 99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352
353
354
355
356
357
358
359
360
361
362
363
364
365
366
367
368
369
370
371
372
373
374
375
376
377
378
379
380
381
382
383
384
385
386
387
388
389
390
391
392
393
394
395
396
397
398
399
400
401
402
403
404
405
406
407
408
409
410
411
412
413
414
415
416
417
418
419
420
421
422
423
424
425
426
427
428
429
430
431
432
433
434
435
436
437
438
439
440
441
442
443
444
445
446
447
448
449
450
451
452
453
454
455
456
457
458
459
460
461
462
463
464
465
466

# Prepended to each published runbook by Publish-RunnerRunbooks.ps1.
$ErrorActionPreference = 'Stop'
$script:ArmRoot = 'https://management.azure.com'
$script:AzureTokens = @{}
$script:GitHubToken = $null
$script:LeaseId = $null
$script:ReadOnlyProbe = $false

function Get-SydneyZone {
    try { return [TimeZoneInfo]::FindSystemTimeZoneById('Australia/Sydney') }
    catch [TimeZoneNotFoundException] {
        # Windows PowerShell's .NET Framework only understands Windows zone IDs.
        return [TimeZoneInfo]::FindSystemTimeZoneById('AUS Eastern Standard Time')
    }
}

function Get-SydneyWindow {
    param([datetimeoffset]$Now = [datetimeoffset]::UtcNow)
    $zone = Get-SydneyZone
    $local = [TimeZoneInfo]::ConvertTime($Now, $zone)
    $day = [datetime]::SpecifyKind($local.Date, [DateTimeKind]::Unspecified)
    $start = [TimeZoneInfo]::ConvertTimeToUtc($day.AddMinutes(30), $zone)
    $warning = [TimeZoneInfo]::ConvertTimeToUtc($day.AddHours(6).AddMinutes(30), $zone)
    $hard = [TimeZoneInfo]::ConvertTimeToUtc($day.AddHours(7), $zone)
    return @{
        date = $day.ToString('yyyy-MM-dd')
        start = [datetimeoffset]$start
        warning = [datetimeoffset]$warning
        hard = [datetimeoffset]$hard
    }
}

function ConvertFrom-RunnerConfig {
    param($Value)
    for ($depth = 0; $depth -lt 2 -and $Value -is [string]; $depth++) {
        try { $Value = ConvertFrom-Json -InputObject $Value -NoEnumerate -ErrorAction Stop }
        catch { throw 'RunnerConfig contains invalid JSON.' }
    }
    if ($Value -is [System.Collections.IDictionary]) { return [pscustomobject]$Value }
    if ($null -eq $Value -or $Value.GetType() -ne [System.Management.Automation.PSCustomObject]) {
        throw 'RunnerConfig must decode to an object within two JSON layers.'
    }
    return $Value
}

function Initialize-Runner {
    $raw = Get-AutomationVariable -Name 'RunnerConfig'
    $script:Config = ConvertFrom-RunnerConfig $raw
    if ($script:Config.organization -ne 'ExamplePublishing' -or
        $script:Config.workflows.Count -ne 2 -or
        (@($script:Config.workflows.repository | Sort-Object) -join ',') -ne 'ai-strategy-blog,blog') {
        throw 'RunnerConfig does not match the two-repository contract.'
    }
    $script:StateUrl = "https://$($script:Config.storageAccount).blob.core.windows.net/$($script:Config.stateContainer)/current.json"
    foreach ($workflow in $script:Config.workflows) {
        $days = $workflow.publishDays
        if ($days -isnot [array] -or $days.Count -eq 0 -or
            @($days | Where-Object { $_ -isnot [string] -or $_ -cnotin [enum]::GetNames([DayOfWeek]) }).Count -gt 0 -or
            @($days | Sort-Object -Unique).Count -ne $days.Count) {
            throw "$($workflow.repository): publishDays must be a nonempty array of unique canonical weekday names."
        }
    }
    if (-not $script:Config.alertReceiver) {
        Write-Warning 'No alert receiver configured. Automation job warnings/errors require operator monitoring; activation requires an Azure Monitor action group.'
    }
}

function Get-AzureBearer {
    param([string]$Resource)
    $cached = $script:AzureTokens[$Resource]
    if ($cached -and $cached.expires -gt [datetimeoffset]::UtcNow.AddMinutes(5)) {
        return $cached.token
    }
    if (-not $env:IDENTITY_ENDPOINT -or -not $env:IDENTITY_HEADER) {
        throw 'Azure Automation managed identity endpoint is unavailable.'
    }
    $uri = "$($env:IDENTITY_ENDPOINT)?resource=$([uri]::EscapeDataString($Resource))&api-version=2019-08-01"
    $token = Invoke-RestMethod -Uri $uri -Headers @{
        'X-IDENTITY-HEADER' = $env:IDENTITY_HEADER
        Metadata = 'True'
    } -TimeoutSec 20
    $expiry = if ([string]$token.expires_on -match '^\d+$') {
        [datetimeoffset]::FromUnixTimeSeconds([long]$token.expires_on)
    } else { [datetimeoffset]::Parse($token.expires_on) }
    $script:AzureTokens[$Resource] = @{ token = $token.access_token; expires = $expiry }
    return $token.access_token
}

function Invoke-Azure {
    param([string]$Uri, [string]$Method = 'GET', $Body = $null,
        [string]$Resource = 'https://management.azure.com/', [hashtable]$Headers = @{})
    if ($script:ReadOnlyProbe -and $Method -ne 'GET') { throw 'Read-only probe forbids Azure mutations.' }
    $headersCopy = @{
        Authorization = "Bearer $(Get-AzureBearer $Resource)"
        'Content-Type' = 'application/json'
    }
    foreach ($key in $Headers.Keys) { $headersCopy[$key] = $Headers[$key] }
    $arguments = @{ Uri = $Uri; Method = $Method; Headers = $headersCopy; TimeoutSec = 30; UseBasicParsing = $true }
    if ($null -ne $Body) { $arguments.Body = $Body | ConvertTo-Json -Depth 30 -Compress }
    try {
        $response = Invoke-WebRequest @arguments
        if ($response.Content) { return ($response.Content | ConvertFrom-Json) }
    } catch {
        # Never include response bodies: identity/Key Vault errors can contain sensitive material.
        $status = 0
        if ($_.Exception.Response) { $status = [int]$_.Exception.Response.StatusCode }
        throw "Azure $Method failed (HTTP $status). No automatic retry of a state-changing request."
    }
}

function Invoke-StateRequest {
    param([string]$Method, [string]$Suffix = '', $Body = $null, [hashtable]$Headers = @{})
    if ($script:ReadOnlyProbe -and $Method -ne 'GET') { throw 'Read-only probe forbids state or lease mutations.' }
    $allHeaders = @{
        Authorization = "Bearer $(Get-AzureBearer 'https://storage.azure.com/')"
        'x-ms-version' = '2023-11-03'
        'x-ms-date' = [datetime]::UtcNow.ToString('R')
    }
    foreach ($key in $Headers.Keys) { $allHeaders[$key] = $Headers[$key] }
    $arguments = @{
        Uri = "$script:StateUrl$Suffix"; Method = $Method; Headers = $allHeaders
        TimeoutSec = 10; UseBasicParsing = $true
    }
    if ($null -ne $Body) {
        $arguments.Body = [Text.Encoding]::UTF8.GetBytes(($Body | ConvertTo-Json -Depth 30 -Compress))
        $arguments.ContentType = 'application/json'
    }
    # Callers need 404/409/412 to distinguish missing state and competing leases.
    return Invoke-WebRequest @arguments
}

function Get-HttpStatus {
    param($Failure)
    if ($Failure.Exception.Response) { return [int]$Failure.Exception.Response.StatusCode }
    return 0
}

function Read-Cycle {
    try {
        $response = Invoke-StateRequest GET
        return ($response.Content | ConvertFrom-Json)
    } catch {
        if ((Get-HttpStatus $_) -eq 404) { return $null }
        throw 'Durable cycle read failed; no in-memory fallback is allowed.'
    }
}

function Enter-CycleLease {
    if ($script:ReadOnlyProbe) { throw 'Read-only probe forbids lease acquisition.' }
    # The same blob holds both the lease and durable state; no separate lock can drift.
    try {
        $null = Invoke-StateRequest PUT -Body @{ schema = 3; phase = 'idle' } -Headers @{
            'x-ms-blob-type' = 'BlockBlob'; 'If-None-Match' = '*'
        }
    } catch {
        if ((Get-HttpStatus $_) -notin @(409, 412)) { throw 'Cannot initialize durable cycle blob.' }
    }
    try {
        $response = Invoke-StateRequest PUT '?comp=lease' -Headers @{
            'x-ms-lease-action' = 'acquire'; 'x-ms-lease-duration' = '60'
        }
        $script:LeaseId = [string]$response.Headers['x-ms-lease-id']
        if (-not $script:LeaseId) { throw 'Storage did not return a lease ID.' }
        return $true
    } catch {
        if ((Get-HttpStatus $_) -eq 409) { return $false }
        throw 'Cannot acquire cycle lease.'
    }
}

function Update-CycleLease {
    if ($script:ReadOnlyProbe) { throw 'Read-only probe forbids lease renewal.' }
    if (-not $script:LeaseId) { throw 'Cycle mutation requires a lease.' }
    try {
        $null = Invoke-StateRequest PUT '?comp=lease' -Headers @{
            'x-ms-lease-action' = 'renew'; 'x-ms-lease-id' = $script:LeaseId
        }
    } catch { throw 'Lost cycle lease; refusing further dispatch or state mutation.' }
}

function Write-Cycle {
    param($Cycle)
    if ($script:ReadOnlyProbe) { throw 'Read-only probe forbids cycle mutations.' }
    Update-CycleLease
    $Cycle.updatedUtc = [datetimeoffset]::UtcNow.ToString('o')
    try {
        $null = Invoke-StateRequest PUT -Body $Cycle -Headers @{
            'x-ms-blob-type' = 'BlockBlob'; 'x-ms-lease-id' = $script:LeaseId
        }
    } catch { throw 'Durable cycle write failed; refusing to continue.' }
}

function Exit-CycleLease {
    if ($script:ReadOnlyProbe) { throw 'Read-only probe forbids lease release.' }
    if ($script:LeaseId) {
        try {
            $null = Invoke-StateRequest PUT '?comp=lease' -Headers @{
                'x-ms-lease-action' = 'release'; 'x-ms-lease-id' = $script:LeaseId
            }
        } catch { Write-Warning 'Lease release failed; the 60-second lease will expire.' }
        $script:LeaseId = $null
    }
}

function ConvertTo-Base64Url {
    param([byte[]]$Bytes)
    return [Convert]::ToBase64String($Bytes).TrimEnd('=').Replace('+', '-').Replace('/', '_')
}

function Get-GitHubBearer {
    if ($script:GitHubToken -and $script:GitHubToken.expires -gt [datetimeoffset]::UtcNow.AddMinutes(5)) {
        return $script:GitHubToken.token
    }
    if (-not $script:Config.githubAppId -or -not $script:Config.githubInstallationId) {
        throw 'GitHub App onboarding incomplete: App ID and installation ID are required. Interactive GH_TOKEN is never used.'
    }
    $key = Invoke-Azure -Uri "https://$($script:Config.vaultName).vault.azure.net/secrets/$($script:Config.githubKeySecretName)?api-version=7.4" -Resource 'https://vault.azure.net'
    if (-not $script:ReadOnlyProbe) { Update-CycleLease }
    $rsa = [Security.Cryptography.RSA]::Create()
    try {
        $rsa.ImportFromPem($key.value)
        $now = [datetimeoffset]::UtcNow.ToUnixTimeSeconds()
        $header = ConvertTo-Base64Url ([Text.Encoding]::UTF8.GetBytes('{"alg":"RS256","typ":"JWT"}'))
        $payload = @{ iat = $now - 60; exp = $now + 540; iss = $script:Config.githubAppId } | ConvertTo-Json -Compress
        $unsigned = "$header.$(ConvertTo-Base64Url ([Text.Encoding]::UTF8.GetBytes($payload)))"
        $signature = $rsa.SignData([Text.Encoding]::UTF8.GetBytes($unsigned),
            [Security.Cryptography.HashAlgorithmName]::SHA256, [Security.Cryptography.RSASignaturePadding]::Pkcs1)
        $jwt = "$unsigned.$(ConvertTo-Base64Url $signature)"
    } finally { $rsa.Dispose(); $key = $null }
    try {
        $token = Invoke-RestMethod -Method POST `
            -Uri "https://api.github.com/app/installations/$($script:Config.githubInstallationId)/access_tokens" `
            -Headers @{ Authorization = "Bearer $jwt"; Accept = 'application/vnd.github+json'; 'X-GitHub-Api-Version' = '2022-11-28' } `
            -ContentType 'application/json' -Body '{}' -TimeoutSec 20
    } catch { throw 'GitHub App installation-token creation failed. Check installation and permissions; no PAT fallback.' }
    finally { $jwt = $null }
    $script:GitHubToken = @{ token = $token.token; expires = [datetimeoffset]::Parse($token.expires_at) }
    return $token.token
}

function Invoke-GitHub {
    param([string]$Path, [string]$Method = 'GET', $Body = $null)
    # Each API call renews the lease; token minting is bounded separately below.
    if ($script:ReadOnlyProbe -and $Method -ne 'GET') { throw 'Read-only probe forbids GitHub mutations.' }
    if (-not $script:ReadOnlyProbe) { Update-CycleLease }
    $bearer = Get-GitHubBearer
    if (-not $script:ReadOnlyProbe) { Update-CycleLease }
    if ($Method -eq 'POST' -and $Path.EndsWith('/dispatches')) {
        $window = Get-SydneyWindow
        if ([datetimeoffset]::UtcNow -lt $window.start -or [datetimeoffset]::UtcNow -ge $window.warning -or $Body.inputs.publish_date -ne $window.date) {
            throw 'Dispatch deadline/date changed during authentication; refusing a late or stale publishing request.'
        }
    }
    $arguments = @{
        Uri = "https://api.github.com$Path"; Method = $Method; TimeoutSec = 20
        Headers = @{
            Authorization = "Bearer $bearer"; Accept = 'application/vnd.github+json'
            'X-GitHub-Api-Version' = '2022-11-28'
        }
    }
    if ($null -ne $Body) { $arguments.Body = $Body | ConvertTo-Json -Depth 15 -Compress; $arguments.ContentType = 'application/json' }
    try { return Invoke-RestMethod @arguments }
    catch {
        $status = Get-HttpStatus $_
        throw "GitHub $Method failed (HTTP $status). Check permission/rate-limit status. Mutations are not automatically retried."
    }
}

function Find-CorrelatedRun {
    param($Cycle, $Target)
    $matches = @()
    $created = [uri]::EscapeDataString(">=$([datetimeoffset]::Parse($Cycle.startedUtc).AddMinutes(-5).ToString('yyyy-MM-ddTHH:mm:ssZ'))")
    $workflow = [uri]::EscapeDataString($Target.workflow)
    for ($page = 1; $page -le 5; $page++) {
        $result = Invoke-GitHub "/repos/$($script:Config.organization)/$($Target.repository)/actions/workflows/$workflow/runs?event=workflow_dispatch&branch=main&created=$created&per_page=50&page=$page"
        $matches += @($result.workflow_runs | Where-Object {
            $_.display_title -eq "Azure daily publish / $($Cycle.cycleId)" -and
            $_.event -eq 'workflow_dispatch' -and $_.head_branch -eq 'main'
        })
        if (@($result.workflow_runs).Count -lt 50) { break }
        if ($page -eq 5) { throw 'Run discovery exceeded 250 runs; refusing an incomplete correlation search.' }
    }
    if ($matches.Count -gt 1) { throw 'Duplicate correlated runs detected; operator intervention required.' }
    if ($matches.Count -eq 1) { return $matches[0] }
    return $null
}

function Get-DueWorkflows {
    param([string]$PublishDate)
    $day = [datetime]::ParseExact($PublishDate, 'yyyy-MM-dd', [Globalization.CultureInfo]::InvariantCulture)
    return @($script:Config.workflows | Where-Object { $day.DayOfWeek.ToString() -cin $_.publishDays })
}

function Write-NoSitesScheduled {
    param([string]$PublishDate)
    $day = [datetime]::ParseExact($PublishDate, 'yyyy-MM-dd', [Globalization.CultureInfo]::InvariantCulture)
    Write-Output "No sites scheduled for $PublishDate ($($day.DayOfWeek))"
}

function Test-CycleTargets {
    param($Cycle)
    $due = @(Get-DueWorkflows $Cycle.publishDate)
    $actual = @($Cycle.targets.repository | Sort-Object)
    $matches = @($Cycle.targets | Where-Object {
        $target = $_
        @($due | Where-Object {
            $_.repository -ceq $target.repository -and $_.workflow -ceq $target.workflow -and $_.ref -ceq $target.ref
        }).Count -eq 1
    })
    return $Cycle.schema -eq 3 -and $Cycle.execution -eq 'github-hosted' -and $due.Count -gt 0 -and $matches.Count -eq $due.Count -and
        $actual.Count -eq $due.Count -and
        ($actual -join ',') -ceq (@($due.repository | Sort-Object) -join ',')
}

function New-PublishingCycle {
    param($Window)
    $due = @(Get-DueWorkflows $Window.date)
    if ($due.Count -eq 0) { throw 'Cannot create a publishing cycle with no scheduled sites.' }
    $targets = @($due | ForEach-Object {
        @{
            repository = $_.repository; workflow = $_.workflow; ref = $_.ref
            stage = 'pending'; runId = $null; dispatchedUtc = $null
            status = $null; conclusion = $null
        }
    })
    return @{
        schema = 3; execution = 'github-hosted'; phase = 'running'; cycleId = [guid]::NewGuid().ToString()
        publishDate = $Window.date; startedUtc = [datetimeoffset]::UtcNow.ToString('o')
        warningUtc = $Window.warning.ToString('o'); verificationDeadlineUtc = $Window.hard.ToString('o')
        updatedUtc = $null; error = $null; targets = $targets
    }
}

function Test-AllTerminal {
    param($Cycle)
    return (Test-CycleTargets $Cycle) -and @($Cycle.targets | Where-Object {
        -not $_.runId -or $_.status -ne 'completed'
    }).Count -eq 0
}

function Test-CycleSuccess {
    param($Cycle)
    return -not $Cycle.error -and (Test-AllTerminal $Cycle) -and @($Cycle.targets | Where-Object { $_.conclusion -ne 'success' }).Count -eq 0
}

function Assert-PublishingConfiguration {
    if (-not $script:Config.githubAppId -or -not $script:Config.githubInstallationId) {
        throw 'GitHub App onboarding incomplete: App ID and installation ID are required. Interactive GH_TOKEN is never used.'
    }
    if (-not $script:Config.alertReceiver -or $script:Config.alertReceiver -notmatch
        '^/subscriptions/[^/]+/resourceGroups/[^/]+/providers/Microsoft\.Insights/actionGroups/[^/]+$') {
        throw 'Publishing activation blocked: verified Azure Monitor action-group receiver is required.'
    }
}

function Assert-WorkflowReadiness {
    param($Workflows = $script:Config.workflows)
    Assert-PublishingConfiguration
    foreach ($target in $Workflows) {
        if ($target.ref -ne 'main') { throw 'Only main is authorized.' }
        $workflow = Invoke-GitHub "/repos/$($script:Config.organization)/$($target.repository)/actions/workflows/$($target.workflow)"
        if ($workflow.state -ne 'active') { throw "$($target.repository): target workflow is not active." }
    }
}

function Update-PublishingCycle {
    param($Cycle)
    Update-CycleLease
    if (-not (Test-CycleTargets $Cycle)) { throw 'Cycle targets do not match the configured publishing cadence or schema.' }
    if ($Cycle.phase -eq 'finished') {
        if (-not (Test-CycleSuccess $Cycle)) { throw 'Finished publication failed verification.' }
        return
    }
    if ($Cycle.phase -ne 'running') { throw 'Unsupported persisted phase; operator recovery required.' }
    Assert-WorkflowReadiness @(Get-DueWorkflows $Cycle.publishDate)
        foreach ($target in $Cycle.targets) {
            if ($target.stage -eq 'pending') {
                $window = Get-SydneyWindow
                if ([datetimeoffset]::UtcNow -lt $window.start -or
                    [datetimeoffset]::UtcNow -ge $window.warning -or $Cycle.publishDate -ne $window.date) {
                    throw 'Undispatched site outside the authorized publishing window; no late dispatch.'
                }
                $target.stage = 'ambiguous'
                $target.dispatchedUtc = [datetimeoffset]::UtcNow.ToString('o')
                Write-Cycle $Cycle
                # Ambiguous stage is durable BEFORE the network side effect. Never redispatch.
                $null = Invoke-GitHub "/repos/$($script:Config.organization)/$($target.repository)/actions/workflows/$($target.workflow)/dispatches" POST @{
                    ref = 'main'
                    inputs = @{ cycle_id = $Cycle.cycleId; publish_date = $Cycle.publishDate }
                }
                $target.stage = 'dispatched'
                Write-Cycle $Cycle
            }
            if (-not $target.runId -and $target.stage -in @('ambiguous', 'dispatched')) {
                $run = Find-CorrelatedRun $Cycle $target
                if (-not $run) {
                    Write-Warning "Awaiting exact run correlation for $($target.repository); no dispatch retry."
                    # Sequential dispatch: discover and persist the first run before dispatching the second.
                    break
                }
                $target.runId = [long]$run.id
                $target.stage = 'known'
                Write-Cycle $Cycle
            }
            if ($target.runId) {
                $run = Invoke-GitHub "/repos/$($script:Config.organization)/$($target.repository)/actions/runs/$($target.runId)"
                if ($run.display_title -ne "Azure daily publish / $($Cycle.cycleId)" -or
                    $run.head_branch -ne 'main' -or $run.event -ne 'workflow_dispatch') {
                    throw 'Persisted run no longer matches cycle identity.'
                }
                $target.status = $run.status
                $target.conclusion = $run.conclusion
                Write-Cycle $Cycle
            }
        }
        if (Test-AllTerminal $Cycle) {
            $late = [datetimeoffset]::UtcNow -ge [datetimeoffset]::Parse($Cycle.verificationDeadlineUtc)
            $Cycle.phase = 'finished'
            $Cycle.error = if (Test-CycleSuccess $Cycle) { $null } else { 'Scheduled publishing workflows did not succeed.' }
            if ($late) { $Cycle.error = 'Publication was not verified before 07:00 Sydney; late completion is not timely success.' }
            Write-Cycle $Cycle
            if ($Cycle.error) { throw $Cycle.error }
            Write-Output "Verified hosted publication: $($Cycle.cycleId)."
        }
        if ($Cycle.phase -ne 'finished' -and [datetimeoffset]::UtcNow -ge [datetimeoffset]::Parse($Cycle.verificationDeadlineUtc)) {
            $Cycle.error = 'No verified successful publication by 07:00 Sydney; hosted runs are not cancelled.'
            Write-Cycle $Cycle
            throw $Cycle.error
        }
}

function Invoke-PublishingJob {
    param([switch]$Recovery)
    $window = Get-SydneyWindow
    if (@(Get-DueWorkflows $window.date).Count -eq 0) { return }
    $now = [datetimeoffset]::UtcNow
    if ($now -lt $window.start) { throw 'Publishing cannot start before 00:30 Sydney.' }
    if (-not (Enter-CycleLease)) { throw 'Controller lease held; another job owns publication.' }
    try {
        $cycle = Read-Cycle
        $idle = $null -eq $cycle -or ($cycle.schema -in @(1, 2, 3) -and
            $cycle.phase -eq 'idle' -and -not $cycle.publishDate -and -not $cycle.targets)
        if ($cycle -and $cycle.phase -eq 'idle' -and -not $idle) { throw 'Malformed or unsupported idle state.' }
        if (-not $idle -and $cycle.publishDate -ne $window.date -and $cycle.phase -ne 'finished') {
            throw 'Previous cycle unresolved; refusing to overwrite or redispatch.'
        }
        if ($idle -or $cycle.publishDate -ne $window.date) {
            if ($now -ge $window.warning) { throw "No verified successful publishing cycle for $($window.date) by 06:30 Sydney." }
            Assert-WorkflowReadiness @(Get-DueWorkflows $window.date)
            $cycle = New-PublishingCycle $window
            Write-Cycle $cycle
        }
        $end = $now.AddMinutes(15)
        if ($Recovery -and $now -ge $window.warning -and $now -lt $window.hard) { $end = $window.hard }
        do {
            Update-PublishingCycle $cycle
            if ($cycle.phase -eq 'finished') { return }
            if ([datetimeoffset]::UtcNow -ge $end) { break }
            # Renew during waits; never sleep for the full 60-second lease duration.
            Update-CycleLease
            Start-Sleep -Seconds 20
        } while ($true)
        if ([datetimeoffset]::UtcNow -ge $window.hard) { throw 'No verified successful publication by 07:00 Sydney.' }
        Write-Warning 'Bounded polling ended; the recovery/deadline job must verify persisted runs.'
    } finally { Exit-CycleLease }
}

1
2

Initialize-Runner
Invoke-PublishingJob

1
2
3

# Name retained for existing monitoring and operator integration.
Initialize-Runner
Invoke-PublishingJob -Recovery

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24

# Safe manual probe at any time: no durable writes or workflow dispatch.
Initialize-Runner
Assert-PublishingConfiguration
$script:ReadOnlyProbe = $true
try {
$cycle = Read-Cycle
if ($null -eq $cycle) {
    Write-Output 'Persisted state: absent; no cycle created.'
} else {
    $targetCount = @($cycle.targets | Where-Object { $null -ne $_ }).Count
    Write-Output "Persisted state: schema=$($cycle.schema); phase=$($cycle.phase); publishDate=$($cycle.publishDate); targetCount=$targetCount."
    if ($cycle.phase -notin @('idle', 'finished')) { throw 'Readiness refused: active persisted cycle requires watchdog/operator recovery.' }
    $idle = $cycle.phase -eq 'idle' -and -not $cycle.publishDate -and $targetCount -eq 0
    if ($cycle.schema -notin @(1, 2, 3) -or ($cycle.schema -ne 3 -and -not $idle)) {
        throw 'Readiness refused: unsupported legacy persisted state; do not relabel historical deployments.'
    }
    if ($cycle.phase -eq 'idle' -and -not $idle) { throw 'Readiness refused: malformed idle state.' }
    if ($cycle.phase -eq 'finished' -and -not (Test-CycleTargets $cycle)) {
        throw 'Readiness refused: persisted target set does not match cadence.'
    }
}
Assert-WorkflowReadiness
Write-Output 'App authentication and hosted publishing workflows verified. Read-only state inspection; no lease or dispatch performed.'
} finally { $script:ReadOnlyProbe = $false }

  1
  2
  3
  4
  5
  6
  7
  8
  9
 10
 11
 12
 13
 14
 15
 16
 17
 18
 19
 20
 21
 22
 23
 24
 25
 26
 27
 28
 29
 30
 31
 32
 33
 34
 35
 36
 37
 38
 39
 40
 41
 42
 43
 44
 45
 46
 47
 48
 49
 50
 51
 52
 53
 54
 55
 56
 57
 58
 59
 60
 61
 62
 63
 64
 65
 66
 67
 68
 69
 70
 71
 72
 73
 74
 75
 76
 77
 78
 79
 80
 81
 82
 83
 84
 85
 86
 87
 88
 89
 90
 91
 92
 93
 94
 95
 96
 97
 98
 99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121

targetScope = 'resourceGroup'

param automationName string = 'aa-gh-publishing'
@description('Required existing Log Analytics workspace resource ID. Azure Automation diagnostics use billable ingestion.')
param workspaceResourceId string
@description('Log Analytics workspace region.')
param workspaceLocation string
@description('The approved action group. Existing selected group in rg-management.')
param actionGroupResourceId string = '/subscriptions/<YOUR-SUBSCRIPTION-ID>/resourceGroups/rg-management/providers/Microsoft.Insights/actionGroups/<YOUR-ACTION-GROUP-NAME>'
@description('Enable only after workspace tables and action-group delivery have been verified.')
param monitoringEnabled bool = false
@description('Collect job logs independently so ingestion can be verified before enabling alerts.')
param diagnosticsEnabled bool = monitoringEnabled
@description('Activation time; keep stable on updates.')
param heartbeatStartUtc string = utcNow('u')
@description('Derived union of RunnerConfig publishDays, never maintained as a second cadence source.')
param dueWeekdays array = ['Tuesday', 'Wednesday', 'Thursday', 'Friday']

var automationId = resourceId('Microsoft.Automation/automationAccounts', automationName)

resource automation 'Microsoft.Automation/automationAccounts@2024-10-23' existing = {
  name: automationName
}

resource diagnostics 'Microsoft.Insights/diagnosticSettings@2021-05-01-preview' = {
  name: 'publishing-job-monitoring'
  scope: automation
  properties: {
    workspaceId: workspaceResourceId
    logs: [
      { category: 'JobLogs', enabled: diagnosticsEnabled }
    ]
    metrics: []
  }
}

var watchdogHeartbeatQuery = '''
let localNow = datetime_utc_to_local(now(), 'Australia/Sydney');
let localDay = startofday(localNow);
let weekday = tostring(dynamic(["Sunday", "Monday", "Tuesday", "Wednesday", "Thursday", "Friday", "Saturday"])[toint(dayofweek(localNow) / 1d)]);
let ranToday = toscalar(
    AzureDiagnostics
    | where TimeGenerated > ago(24h)
    | where ResourceId =~ '{0}'
    | where ResourceProvider == "MICROSOFT.AUTOMATION"
    | where Category == "JobLogs"
    | where RunbookName_s == "Stop-RunnerWatchdog"
    | where ResultType == "Completed"
    | where datetime_utc_to_local(TimeGenerated, 'Australia/Sydney') >= localDay + 6h + 30m
    | summarize count());
print MissingHeartbeat = toint(now() >= datetime('{1}') and set_has_element(dynamic({2}), weekday) and localNow >= localDay + 7h + 15m and ranToday == 0)
'''

resource failedJobsAlert 'Microsoft.Insights/metricAlerts@2018-03-01' = {
  name: 'publishing-automation-failures'
  location: 'global'
  properties: {
    description: 'Failed/stopped/suspended publishing controller jobs.'
    enabled: monitoringEnabled
    severity: 2
    evaluationFrequency: 'PT5M'
    windowSize: 'PT15M'
    scopes: [automation.id]
    autoMitigate: true
    criteria: {
      'odata.type': 'Microsoft.Azure.Monitor.SingleResourceMultipleMetricCriteria'
      allOf: [
        {
          name: 'FailedPublishingJob'
          metricName: 'TotalJob'
          metricNamespace: 'Microsoft.Automation/automationAccounts'
          timeAggregation: 'Total'
          operator: 'GreaterThan'
          threshold: 0
          criterionType: 'StaticThresholdCriterion'
          skipMetricValidation: false
          dimensions: [
            { name: 'Runbook', operator: 'Include', values: ['Start-DailyPublishing', 'Stop-RunnerWatchdog'] }
            { name: 'Status', operator: 'Include', values: ['Failed', 'Stopped', 'Suspended'] }
          ]
        }
      ]
    }
    actions: [{ actionGroupId: actionGroupResourceId }]
  }
}

resource missingWatchdogAlert 'Microsoft.Insights/scheduledQueryRules@2023-12-01' = {
  name: 'publishing-watchdog-missed'
  location: workspaceLocation
  kind: 'LogAlert'
  properties: {
    displayName: 'Due-day publishing Automation absent'
    description: 'After 07:15 Sydney on a due day, no completed deadline verification job was ingested. Cadence derived from RunnerConfig.'
    enabled: monitoringEnabled
    severity: 1
    evaluationFrequency: 'PT1H'
    windowSize: 'P1D'
    scopes: [workspaceResourceId]
    autoMitigate: true
    checkWorkspaceAlertsStorageConfigured: false
    skipQueryValidation: true
    criteria: {
      allOf: [
        {
          query: format(watchdogHeartbeatQuery, automationId, heartbeatStartUtc, string(dueWeekdays))
          timeAggregation: 'Maximum'
          metricMeasureColumn: 'MissingHeartbeat'
          operator: 'GreaterThan'
          threshold: 0
          failingPeriods: { numberOfEvaluationPeriods: 1, minFailingPeriodsToAlert: 1 }
        }
      ]
    }
    actions: { actionGroups: [actionGroupResourceId] }
  }
}

output diagnosticSettingId string = diagnostics.id
output failureAlertId string = failedJobsAlert.id
output watchdogMissedAlertId string = missingWatchdogAlert.id

  1
  2
  3
  4
  5
  6
  7
  8
  9
 10
 11
 12
 13
 14
 15
 16
 17
 18
 19
 20
 21
 22
 23
 24
 25
 26
 27
 28
 29
 30
 31
 32
 33
 34
 35
 36
 37
 38
 39
 40
 41
 42
 43
 44
 45
 46
 47
 48
 49
 50
 51
 52
 53
 54
 55
 56
 57
 58
 59
 60
 61
 62
 63
 64
 65
 66
 67
 68
 69
 70
 71
 72
 73
 74
 75
 76
 77
 78
 79
 80
 81
 82
 83
 84
 85
 86
 87
 88
 89
 90
 91
 92
 93
 94
 95
 96
 97
 98
 99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144

name: Azure Static Web Apps CI/CD
run-name: ${{ inputs.cycle_id != '' && format('Azure daily publish / {0}', inputs.cycle_id) || format('{0} / {1}', github.event_name, github.head_ref || github.ref_name) }}

on:
  workflow_dispatch:
    inputs:
      cycle_id:
        description: Azure controller cycle UUID
        type: string
        required: false
        default: ''
      publish_date:
        description: Azure controller publication date (yyyy-MM-dd, Australia/Sydney)
        type: string
        required: false
        default: ''
  schedule:
    # 14:17 UTC = 1:17 AM Sydney during AEDT, 12:17 AM during AEST; allows delay before 7 AM.
    - cron: '17 14 * * *'
  push:
    branches: [ main ]
  pull_request:
    branches: [ main ]
    types: [ opened, synchronize, reopened, closed ]

permissions:
  contents: read
  pull-requests: write
  id-token: write
  deployments: write

concurrency:
  group: ${{ github.event_name == 'pull_request' && format('swa-pr-{0}-{1}', github.event.pull_request.number, github.event.action == 'closed' && 'cleanup' || 'preview') || 'swa-production' }}
  cancel-in-progress: ${{ github.event_name == 'pull_request' }}

jobs:
  admit_publish:
    if: github.event_name == 'push' || (github.event_name == 'schedule' && vars.AZURE_DAILY_PUBLISHING_ENABLED != 'true') || github.event_name == 'workflow_dispatch' || (github.event_name == 'pull_request' && github.event.action != 'closed')
    runs-on: ubuntu-latest
    timeout-minutes: 5
    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-node@v4
        with:
          node-version: '22'
      - name: Validate publication metadata
        env:
          CYCLE_ID: ${{ inputs.cycle_id }}
          PUBLISH_DATE: ${{ inputs.publish_date }}
        run: node scripts/publication-checks.mjs admit

  build_and_deploy_job:
    needs: admit_publish
    runs-on: ubuntu-latest
    timeout-minutes: 30
    name: Build and Deploy
    env:
      CYCLE_ID: ${{ inputs.cycle_id }}
      PUBLISH_DATE: ${{ inputs.publish_date }}

    steps:
      - name: Checkout
        uses: actions/checkout@v4
        with:
          submodules: true
          lfs: false

      - uses: actions/setup-node@v4
        with:
          node-version: '22'

      - name: Revalidate dispatch after runner queue wait
        run: |
          node scripts/publication-checks.mjs admit
          echo "PUBLICATION_MANIFEST=$RUNNER_TEMP/publication-manifest.json" >> "$GITHUB_ENV"

      - name: Cache Hugo resources
        uses: actions/cache@v4
        with:
          path: |
            ~/.cache/hugo
            resources
          key: ${{ runner.os }}-hugo-${{ hashFiles('**/*.toml', '**/*.yaml', '**/*.yml', '**/*.json', 'themes/**', 'config.*') }}
          restore-keys: |
            ${{ runner.os }}-hugo-

      - name: Setup Hugo
        uses: peaceiris/actions-hugo@v3
        with:
          hugo-version: '0.152.2'
          extended: true

      - name: Setup Go for Hugo modules
        uses: actions/setup-go@v5
        with:
          go-version: '1.24.x'
          cache: false

      - name: Test publication guards
        run: npm test

      - name: Resolve publication metadata with Hugo
        run: node scripts/publication-checks.mjs manifest

      - name: Build site
        run: |
          rm -rf -- public
          hugo --minify

      - name: Validate due pages and future exclusions before upload
        run: node scripts/publication-checks.mjs predeploy

      - name: Deploy to Azure Static Web Apps (upload prebuilt)
        uses: Azure/static-web-apps-deploy@v1
        with:
          azure_static_web_apps_api_token: ${{ secrets.AZURE_STATIC_WEB_APPS_API_TOKEN_RED_FLOWER_083307E00 }}
          repo_token: ${{ secrets.GITHUB_TOKEN }}
          action: "upload"

          # IMPORTANT: we are uploading the prebuilt output
          app_location: "public"     # <- point to the built folder
          output_location: ""        # <- no further output folder inside 'public'
          skip_app_build: true       # <- prevents Oryx from building

          # No API in this project
          api_location: ""
          skip_api_build: true

      - name: Verify public production pages
        if: github.event_name != 'pull_request' && github.ref == 'refs/heads/main'
        run: node scripts/publication-checks.mjs postdeploy

  close_pull_request_job:
    if: github.event_name == 'pull_request' && github.event.action == 'closed'
    runs-on: ubuntu-latest
    timeout-minutes: 10
    name: Close Pull Request
    steps:
      - name: Close Pull Request
        uses: Azure/static-web-apps-deploy@v1
        with:
          azure_static_web_apps_api_token: ${{ secrets.AZURE_STATIC_WEB_APPS_API_TOKEN_RED_FLOWER_083307E00 }}
          action: "close"