ci: fix pipeline vulnerabilities

[Vamshi-Microsoft]

Purpose

This pull request introduces several improvements and refactorings to the GitHub Actions workflows, focusing on enhanced input validation, security best practices, and simplification of deployment steps. The most notable changes are the addition of robust input parameter validation for deployment jobs, the explicit setting of permissions for all workflows, and the removal of redundant Azure CLI installation steps.

Workflow input validation improvements:

• Added comprehensive input parameter validation steps to job-cleanup-deployment.yml and job-deploy-linux.yml. These steps check for required fields, enforce naming conventions, and validate formats for inputs such as environment names, Azure locations, resource group names, Docker image tags, and resource IDs. This ensures that invalid or missing parameters are caught early, preventing misconfigured or failed deployments. [1] [2]

Security and permissions:

• Explicitly set permissions: contents: read, actions: read for all workflows, including build-docker-image.yml, deploy-linux.yml, deploy-orchestrator.yml, deploy-windows.yml, deploy.yml, job-cleanup-deployment.yml, and job-deploy-linux.yml. This follows GitHub security best practices by restricting workflow permissions to the minimum required. [1] [2] [3] [4] [5] [6] [7]

Deployment workflow simplification and modernization:

• Removed redundant manual installation of Azure CLI and Azure Developer CLI (azd) in favor of using the official Azure/setup-azd action and relying on pre-installed tools in the deployment runners. This streamlines the setup process and reduces the risk of installation errors. [1] [2] [3] [4]

Environment variable handling:

• Updated environment variable assignment in deploy.yml to use the env: block for the quota check step, instead of exporting variables within the shell script. This aligns with GitHub Actions best practices and improves readability.

Minor shell script improvements:

• Changed the way output variables are set after deployment in deploy.yml to avoid unnecessary export statements and ensure values are properly written to the GitHub Actions environment.

These changes collectively improve the reliability, security, and maintainability of the CI/CD workflows.

Does this introduce a breaking change?

• Yes
• No

Golden Path Validation

• I have tested the primary workflows (the "golden path") to ensure they function correctly without errors.

Deployment Validation

• I have validated the deployment process successfully and all services are running as expected with this change.