Repository navigation
Let forks run CI in a shared subscription and keep CI environments with a tag - #5272
Merged
Jay W (JayDoubleu) merged 3 commits intoOct 21, 2026
Conversation
…th a tag Add the CI_ENV_PREFIX repository variable and a ci_repository tag, so that a fork can run PR and branch CI in a subscription that it shares with this repository. Cleanup, explicit destruction and bootstrap lease recovery act only on groups with the prefix that the repository owns. Add the ci_keep_until tag. Scheduled cleanup does not stop or destroy a CI environment that has the tag on its core or management group.
Unit Test Results0 tests 0 ✅ 0s ⏱️ Results for commit dece11e. ♻️ This comment has been updated with latest results. |
Contributor
There was a problem hiding this comment.
🟡 Changes recommended
Case-sensitive ownership-tag lookups can permit takeover or deletion of another repository’s CI environment.
3 open issues
1 file not reviewed
.github/scripts/package-lock.json: Generated file
What changed in this PR
Adds repository-scoped CI environments to support Azure TRE forks sharing a subscription, plus tags to retain environments during scheduled cleanup.
Changes:
- Adds configurable CI prefixes and repository ownership checks.
- Adds
ci_keep_untilprotection against scheduled stopping and destruction. - Expands tests and documentation, and updates component versions.
| File | Description |
|---|---|
| docs/tre-developers/github-pr-bot-commands.md | Documents destruction scope and keep-tag behavior. |
| docs/tre-admins/setup-instructions/workflows.md | Explains fork configuration and environment retention. |
| devops/version.txt | Bumps DevOps version. |
| devops/tests/test_validate_ci_cleanup.py | Covers fork validation lifecycle. |
| devops/tests/test_recover_bootstrap_lease.py | Tests recovery ownership checks. |
| devops/tests/test_destroy_ci_ref_env.py | Tests scoped explicit destruction. |
| devops/tests/test_clean_ci_validation_envs.py | Tests cleanup ownership and retention. |
| devops/tests/test_ci_environment_id.py | Tests prefixes and ownership rules. |
| devops/tests/test_ci_cleanup_scope.py | Tests cleanup scope and keep tags. |
| devops/tests/test_bootstrap_ci_tags.py | Tests bootstrap ownership tagging. |
| devops/tests/README.md | Adds fork validation prerequisites. |
| devops/terraform/variables.tf | Defines repository ownership input. |
| devops/terraform/main.tf | Applies management ownership tags. |
| devops/terraform/locals.tf | Combines CI ownership tags. |
| devops/terraform/bootstrap.sh | Checks ownership before management-group updates. |
| devops/scripts/validate_ci_cleanup.py | Adapts validation to configured prefixes. |
| devops/scripts/recover_bootstrap_lease.py | Scopes recovery by prefix and owner. |
| devops/scripts/destroy_ci_ref_env.py | Checks repository ownership before destruction. |
| devops/scripts/clean_ci_validation_envs.sh | Filters cleanup and honors keep decisions. |
| devops/scripts/ci_environment_id.py | Adds prefix and ownership helpers. |
| devops/scripts/ci_cleanup_scope.py | Adds scoped planning and retention checks. |
| devops/bootstrap-lease-recovery.md | Documents ownership-aware recovery. |
| core/version.txt | Bumps core version. |
| core/terraform/variables.tf | Defines core repository input. |
| core/terraform/main.tf | Adds core ownership tag. |
| CHANGELOG.md | Records isolation and retention features. |
| .github/workflows/pr_comment_bot.yml | Routes prefixed deployment and destruction. |
| .github/workflows/deploy_tre_reusable.yml | Passes prefix and repository metadata. |
| .github/workflows/deploy_tre_branch.yml | Generates prefixed branch environment names. |
| .github/workflows/clean_validation_envs.yml | Passes cleanup prefix configuration. |
| .github/scripts/package.json | Bumps build-scripts version. |
| .github/scripts/package-lock.json | Synchronizes version metadata. |
| .github/scripts/ci_environment_workflow.test.js | Tests workflow naming and metadata propagation. |
| .github/actions/devcontainer_run_command/action.yml | Forwards ownership metadata into containers. |
Review effort: Balanced
Azure tag names are not case-sensitive, and Azure returns the case that created the tag. Ownership checks in cleanup, explicit destruction, bootstrap and lease recovery read ci_repository and ci_git_ref case-sensitively, so a tag written as CI_Repository looked untagged. Read these tags with lowercase names through one helper, and refuse tag names that differ only in case.
Contributor
There was a problem hiding this comment.
🔵 Needs a closer look
Destructive shared-subscription cleanup and lease recovery warrant maintainer confirmation of the reported live isolation and retention validation.
No open issues 🎉
3 resolved since last review
1 file not reviewed
.github/scripts/package-lock.json: Generated file
Review effort: Balanced
Collaborator
Author
|
/test |
Jay W (JayDoubleu)
marked this pull request as ready for review
October 21, 2026 14:04
|
🤖 pr-bot 🤖 🏃 Running tests: https://github.com/microsoft/AzureTRE/actions/runs/39613580177 (in response to this comment from Jay W (@JayDoubleu)) |
Marcus Robinson (marrobi)
approved these changes
Oct 21, 2026
Marcus Robinson (marrobi)
left a comment
Marcus Robinson (marrobi)
left a comment
Member
There was a problem hiding this comment.
Providing it doesn't break anything, LGTM!
Chris Chapman (ChrisChapman-gh)
approved these changes
Oct 21, 2026
Max Martin (maxmartin-cgi)
approved these changes
Oct 21, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What is being addressed
Many organisations may use Azure TRE as an accelerator. They might copy this repository into their own repository, which becomes their internal upstream. Their developers then work in forks of that copy and open PRs into it. Often, the copy and its forks run CI in the same Azure subscription.
This setup does not work well today:
How is this addressed
CI_ENV_PREFIXrepository variable for the names of CI environments, and aci_repositorytag on the CI groups. Cleanup, explicit destruction and bootstrap lease recovery act only on groups with the prefix that the repository owns.ci_keep_untiltag (a date orforever). Scheduled cleanup does not stop or destroy an environment that has the tag.docs/tre-admins/setup-instructions/workflows.mdanddocs/tre-developers/github-pr-bot-commands.md.CHANGELOG.mdand increment thecore,devopsandbuild-scriptsversions.No change for this repository
This repository does not need any new variable, secret or manual step:
CI_ENV_PREFIX,microsoft/AzureTREuses the default prefixtre. CI environment names stay the same as before.ci_repositorytag still belong to this repository. Cleanup and/test-destroy-envfind them as before.The new behaviour applies only to a repository that sets
CI_ENV_PREFIX, or to an environment that has theci_keep_untiltag.This repository can also use the keep tag. For example, a maintainer can keep a PR environment for a demo, or to debug a failed E2E test without a new deployment. Nothing changes until someone adds the tag to an environment.
Tests
CI_ENV_PREFIX. For PR and branch references, the old and the new code give the same environment names.