dotnet / dnceng

.NET Engineering Services
MIT License
22 stars 15 forks source link

Remove `secret-manager` use from dotnet-helix-machines-ci #3128

Closed dougbu closed 2 hours ago

dougbu commented 2 weeks ago

Discussed secret-manager redundancies between this repo's -ci and -pr pipelines in Teams. With lots of input from @garath and @missymessa (thanks!), we decided to remove the secret-manager checks (one build step and one whole job) from the official pipeline — azure-pipelines.yml.

Note these checks could break our official builds and cause downstream issues.

Release Note Category

Release Note Description

Removed redundant use of secret-manager from the dotnet-helix-machines-ci. Everything we need is done in two other pipelines.

Also added more -ci and -daily pipelines to our build monitoring configuration. We haven't been catching build failures for some pipelines in a timely manner.

dougbu commented 2 weeks ago

Background from internal discussions…

  1. It's unhelpful and therefore unnecessary
  2. Problems with secret-manager (including secrets that need manual rotation) break official builds in addition to the -daily runs. This is what got me concerned originally

it's unhelpful b/c problems w/ secret-manager or the config in the repo are already checked (in an identical fashion) in the -pr pipeline. that is, checks in the -ci pipeline don't add anything useful. the -pr checks already avoid config issues that may break the -daily pipeline

in addition, breaking multiple pipelines, especially when one does our official builds adds no value (or alerts, eventually) over breaking one


we separately noticed our build monitoring isn't filing issues for a number of dotnet-helix-machines repos. I'm updating that configuration as we speak

/cc @missymessa

dougbu commented 1 week ago

Work done and ready for rollout:

dougbu commented 2 hours ago

done