astral/azure-pipelines-review-sync.yml

trigger: none
pr: none

schedules:
  - cron: "*/20 * * * *"
    displayName: "Review decision sync (every 20 minutes)"
    branches:
      include:
        - main
    always: true
    batch: true

variables:
  # Tenant-specific values are expected in a variable group (see templates/variables-tenant.yml).
  # Uncomment the line below after creating the group in your Azure DevOps project.
  - group: vg-astral-cqre
  - template: templates/variables-common.yml

jobs:
  - job: sync_intune_review_decisions
    displayName: Sync Intune reviewer decisions
    condition: eq(variables['ENABLE_WORKLOAD_INTUNE'], 'true')
    pool:
      name: $(AGENT_POOL_NAME)
    steps:
      - checkout: self
        persistCredentials: true

      - task: Bash@3
        displayName: Apply reviewer /reject decisions (Intune)
        condition: eq(variables['ENABLE_PR_REVIEWER_DECISIONS'], 'true')
        inputs:
          targetType: inline
          script: |
            set -euo pipefail
            python3 "$(Build.SourcesDirectory)/scripts/apply_reviewer_rejections.py" \
              --repo-root "$(Build.SourcesDirectory)" \
              --workload "intune" \
              --drift-branch "$(DRIFT_BRANCH_INTUNE)" \
              --baseline-branch "$(BASELINE_BRANCH)"
          workingDirectory: "$(Build.SourcesDirectory)"
          failOnStderr: false
        env:
          SYSTEM_ACCESSTOKEN: $(System.AccessToken)
          SYSTEM_COLLECTIONURI: $(System.CollectionUri)
          SYSTEM_TEAMPROJECT: $(System.TeamProject)
          BUILD_REPOSITORY_ID: $(Build.Repository.ID)

      - task: Bash@3
        displayName: Update automated reviewer summary (Intune)
        condition: eq(variables['ENABLE_PR_REVIEW_SUMMARY'], 'true')
        inputs:
          targetType: inline
          script: |
            set -euo pipefail
            python3 "$(Build.SourcesDirectory)/scripts/update_pr_review_summary.py" \
              --repo-root "$(Build.SourcesDirectory)" \
              --workload "intune" \
              --backup-folder "$(BACKUP_FOLDER)" \
              --reports-subdir "$(REPORTS_SUBDIR)" \
              --drift-branch "$(DRIFT_BRANCH_INTUNE)" \
              --baseline-branch "$(BASELINE_BRANCH)"
          workingDirectory: "$(Build.SourcesDirectory)"
          failOnStderr: false
        env:
          SYSTEM_ACCESSTOKEN: $(System.AccessToken)
          SYSTEM_COLLECTIONURI: $(System.CollectionUri)
          SYSTEM_TEAMPROJECT: $(System.TeamProject)
          BUILD_REPOSITORY_ID: $(Build.Repository.ID)
          ENABLE_PR_AI_SUMMARY: $(ENABLE_PR_AI_SUMMARY)
          AZURE_OPENAI_ENDPOINT: $(AZURE_OPENAI_ENDPOINT)
          AZURE_OPENAI_DEPLOYMENT: $(AZURE_OPENAI_DEPLOYMENT)
          AZURE_OPENAI_API_KEY: $(AZURE_OPENAI_API_KEY)
          AZURE_OPENAI_API_VERSION: $(AZURE_OPENAI_API_VERSION)
          REQUIRE_CHANGE_TICKETS: $(REQUIRE_CHANGE_TICKETS)
          CHANGE_TICKET_REGEX: $(CHANGE_TICKET_REGEX)
          DEBUG_CHANGE_TICKET_THREADS: $(DEBUG_CHANGE_TICKET_THREADS)
          ROLLING_PR_DELAY_REVIEWER_NOTIFICATIONS: $(ROLLING_PR_DELAY_REVIEWER_NOTIFICATIONS)

      - task: Bash@3
        displayName: Queue post-merge remediation from reviewer /reject (Intune)
        condition: eq(variables['AUTO_REMEDIATE_AFTER_MERGE'], 'true')
        inputs:
          targetType: inline
          script: |
            set -euo pipefail
            python3 "$(Build.SourcesDirectory)/scripts/queue_post_merge_restore.py" \
              --workload "intune" \
              --drift-branch "$(DRIFT_BRANCH_INTUNE)" \
              --baseline-branch "$(BASELINE_BRANCH)"
          workingDirectory: "$(Build.SourcesDirectory)"
          failOnStderr: false
        env:
          SYSTEM_ACCESSTOKEN: $(System.AccessToken)
          SYSTEM_COLLECTIONURI: $(System.CollectionUri)
          SYSTEM_TEAMPROJECT: $(System.TeamProject)
          BUILD_REPOSITORY_ID: $(Build.Repository.ID)
          AUTO_REMEDIATE_AFTER_MERGE: $(AUTO_REMEDIATE_AFTER_MERGE)
          AUTO_REMEDIATE_AFTER_MERGE_LOOKBACK_HOURS: $(AUTO_REMEDIATE_AFTER_MERGE_LOOKBACK_HOURS)
          AUTO_REMEDIATE_RESTORE_PIPELINE_ID: $(AUTO_REMEDIATE_RESTORE_PIPELINE_ID)
          AUTO_REMEDIATE_DRY_RUN: $(AUTO_REMEDIATE_DRY_RUN)
          AUTO_REMEDIATE_UPDATE_ASSIGNMENTS: $(AUTO_REMEDIATE_UPDATE_ASSIGNMENTS)
          AUTO_REMEDIATE_REMOVE_OBJECTS: $(AUTO_REMEDIATE_REMOVE_OBJECTS)
          AUTO_REMEDIATE_MAX_WORKERS: $(AUTO_REMEDIATE_MAX_WORKERS)
          AUTO_REMEDIATE_EXCLUDE_CSV: $(AUTO_REMEDIATE_EXCLUDE_CSV)
          AUTO_REMEDIATE_INCLUDE_ENTRA_UPDATE: false

  - job: sync_entra_review_decisions
    displayName: Sync Entra reviewer decisions
    condition: eq(variables['ENABLE_WORKLOAD_ENTRA'], 'true')
    pool:
      name: $(AGENT_POOL_NAME)
    steps:
      - checkout: self
        persistCredentials: true

      - task: Bash@3
        displayName: Apply reviewer /reject decisions (Entra)
        condition: eq(variables['ENABLE_PR_REVIEWER_DECISIONS'], 'true')
        inputs:
          targetType: inline
          script: |
            set -euo pipefail
            python3 "$(Build.SourcesDirectory)/scripts/apply_reviewer_rejections.py" \
              --repo-root "$(Build.SourcesDirectory)" \
              --workload "entra" \
              --drift-branch "$(DRIFT_BRANCH_ENTRA)" \
              --baseline-branch "$(BASELINE_BRANCH)"
          workingDirectory: "$(Build.SourcesDirectory)"
          failOnStderr: false
        env:
          SYSTEM_ACCESSTOKEN: $(System.AccessToken)
          SYSTEM_COLLECTIONURI: $(System.CollectionUri)
          SYSTEM_TEAMPROJECT: $(System.TeamProject)
          BUILD_REPOSITORY_ID: $(Build.Repository.ID)

      - task: Bash@3
        displayName: Update automated reviewer summary (Entra)
        condition: eq(variables['ENABLE_PR_REVIEW_SUMMARY'], 'true')
        inputs:
          targetType: inline
          script: |
            set -euo pipefail
            python3 "$(Build.SourcesDirectory)/scripts/update_pr_review_summary.py" \
              --repo-root "$(Build.SourcesDirectory)" \
              --workload "entra" \
              --backup-folder "$(BACKUP_FOLDER)" \
              --reports-subdir "$(REPORTS_SUBDIR)" \
              --drift-branch "$(DRIFT_BRANCH_ENTRA)" \
              --baseline-branch "$(BASELINE_BRANCH)"
          workingDirectory: "$(Build.SourcesDirectory)"
          failOnStderr: false
        env:
          SYSTEM_ACCESSTOKEN: $(System.AccessToken)
          SYSTEM_COLLECTIONURI: $(System.CollectionUri)
          SYSTEM_TEAMPROJECT: $(System.TeamProject)
          BUILD_REPOSITORY_ID: $(Build.Repository.ID)
          ENABLE_PR_AI_SUMMARY: $(ENABLE_PR_AI_SUMMARY)
          AZURE_OPENAI_ENDPOINT: $(AZURE_OPENAI_ENDPOINT)
          AZURE_OPENAI_DEPLOYMENT: $(AZURE_OPENAI_DEPLOYMENT)
          AZURE_OPENAI_API_KEY: $(AZURE_OPENAI_API_KEY)
          AZURE_OPENAI_API_VERSION: $(AZURE_OPENAI_API_VERSION)
          REQUIRE_CHANGE_TICKETS: $(REQUIRE_CHANGE_TICKETS)
          CHANGE_TICKET_REGEX: $(CHANGE_TICKET_REGEX)
          DEBUG_CHANGE_TICKET_THREADS: $(DEBUG_CHANGE_TICKET_THREADS)
          ROLLING_PR_DELAY_REVIEWER_NOTIFICATIONS: $(ROLLING_PR_DELAY_REVIEWER_NOTIFICATIONS)

      - task: Bash@3
        displayName: Queue post-merge remediation from reviewer /reject (Entra)
        condition: eq(variables['AUTO_REMEDIATE_AFTER_MERGE'], 'true')
        inputs:
          targetType: inline
          script: |
            set -euo pipefail
            python3 "$(Build.SourcesDirectory)/scripts/queue_post_merge_restore.py" \
              --workload "entra" \
              --drift-branch "$(DRIFT_BRANCH_ENTRA)" \
              --baseline-branch "$(BASELINE_BRANCH)"
          workingDirectory: "$(Build.SourcesDirectory)"
          failOnStderr: false
        env:
          SYSTEM_ACCESSTOKEN: $(System.AccessToken)
          SYSTEM_COLLECTIONURI: $(System.CollectionUri)
          SYSTEM_TEAMPROJECT: $(System.TeamProject)
          BUILD_REPOSITORY_ID: $(Build.Repository.ID)
          AUTO_REMEDIATE_AFTER_MERGE: $(AUTO_REMEDIATE_AFTER_MERGE)
          AUTO_REMEDIATE_AFTER_MERGE_LOOKBACK_HOURS: $(AUTO_REMEDIATE_AFTER_MERGE_LOOKBACK_HOURS)
          AUTO_REMEDIATE_RESTORE_PIPELINE_ID: $(AUTO_REMEDIATE_RESTORE_PIPELINE_ID)
          AUTO_REMEDIATE_DRY_RUN: $(AUTO_REMEDIATE_DRY_RUN)
          AUTO_REMEDIATE_UPDATE_ASSIGNMENTS: $(AUTO_REMEDIATE_UPDATE_ASSIGNMENTS)
          AUTO_REMEDIATE_REMOVE_OBJECTS: $(AUTO_REMEDIATE_REMOVE_OBJECTS)
          AUTO_REMEDIATE_MAX_WORKERS: $(AUTO_REMEDIATE_MAX_WORKERS)
          AUTO_REMEDIATE_EXCLUDE_CSV: $(AUTO_REMEDIATE_EXCLUDE_CSV)
          AUTO_REMEDIATE_INCLUDE_ENTRA_UPDATE: true