[DevOps] PR Builds: PR deployment and cleanup workflows by flanakin · Pull Request #2033 · microsoft/finops-toolkit

flanakin · 2026-02-28T11:47:41Z

🛠️ Description

Adds two GitHub Actions workflows for per-PR template deployment CI:

`ftk-pr-deploy.yml`

Triggers on PRs that change src/templates/** files (excluding docs/tests)
Parses PR body checkboxes (from [DevOps] PR Builds: Add deployment checkboxes to PR template #2031) to determine which deployments to run
6 deployment variants run in parallel with isolated resource groups (pr-{number}-{variant}):
- Hubs with ADX (managed exports)
- Hubs with Fabric (manual exports)
- Hubs storage-only (manual exports)
- Hubs storage-only (no data)
- Workbooks
- Alerts
Posts PR comments with deployment status and Azure portal links
Supports fork PRs via Needs: Deployment label + pull_request_target (verifies no .github/ modifications)
Concurrency group cancels in-progress deployments on new pushes

`ftk-pr-cleanup.yml`

Triggers on PR close (merged or not)
Deletes all resource groups matching pr-{number}-*
Posts cleanup confirmation comment
Creates a GitHub issue assigned to the PR author if cleanup fails

Dependencies

PR A ([DevOps] PR Builds: Add PR deployment support to Deploy-Hub #2030): Deploy-Hub -PR, -Scope, -ManagedExports parameters
PR B ([DevOps] PR Builds: Add deployment checkboxes to PR template #2031): PR template deployment checkboxes
PR C ([DevOps] PR Builds: Create Initialize-CI script to setup CI #2032): Initialize-CI.ps1 for one-time environment setup

This is PR D (final) of a multi-PR effort to add per-PR deployment CI.

📋 Checklist

🔬 How did you test this change?

🤏 Lint tests

🤞 PS -WhatIf / az validate

👍 Manually deployed + verified

💪 Unit tests

🙌 Integration tests

🙋‍♀️ Do any of the following that apply?

🚨 This is a breaking change.

🤏 The change is less than 20 lines of code.

📑 Did you update `docs/changelog.md`?

✅ Updated changelog (required for dev PRs)

➡️ Will add log in a future PR (feature branch PRs only)

❎ Log not needed (small/internal change)

📖 Did you update documentation?

✅ Public docs in docs (required for dev)

✅ Public docs in docs-mslearn (required for dev)

✅ Internal dev docs in docs-wiki (required for dev)

✅ Internal dev docs in src (required for dev)

➡️ Will add docs in a future PR (feature branch PRs only)

❎ Docs not needed (small/internal change)

Creates two GitHub Actions workflows for per-PR template deployments: ftk-pr-deploy.yml: - Triggers on PRs that change src/templates/** files - Parses PR body checkboxes to determine deployment variants - Supports: ADX (managed), Fabric (manual), manual, no-data, workbooks, alerts - Each variant deploys in parallel with isolated resource groups (pr-{number}-{variant}) - Posts PR comments with deployment status and portal links - Supports fork PRs via "Needs: Deployment" label + pull_request_target - Verifies fork PRs don't modify .github/ files ftk-pr-cleanup.yml: - Triggers on PR close (merged or not) - Deletes all resource groups matching pr-{number}-* - Posts cleanup confirmation comment - Creates GitHub issue assigned to PR author if cleanup fails Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

Copilot

Pull request overview

Adds GitHub Actions workflows to support per-PR Azure template deployments (FinOps hubs + variants, workbooks, alerts) and automatic cleanup of PR-specific resource groups, aligning with the toolkit’s CI automation goals for validating src/templates/** changes.

Changes:

Introduces ftk-pr-deploy.yml to parse PR-body deployment checkboxes and run selected deployments with PR-scoped resource groups.
Introduces ftk-pr-cleanup.yml to delete PR-scoped resource groups on PR close and notify via PR comment / issue on failure.

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated 10 comments.

File	Description
`.github/workflows/ftk-pr-deploy.yml`	New per-PR deployment workflow (checkbox parsing, fork label gating, parallel deployment jobs, PR comments).
`.github/workflows/ftk-pr-cleanup.yml`	New cleanup workflow to remove `pr-{number}-*` resource groups and report failures.

Copilot · 2026-02-28T11:53:53Z

.github/workflows/ftk-pr-deploy.yml

+      - name: Parse deployment checkboxes
+        id: parse
+        run: |
+          body='${{ github.event.pull_request.body }}'
+
+          parse_checkbox() {
+            local pattern="$1"
+            local output_name="$2"
+            if echo "$body" | grep -qE "\- \[x\] $pattern"; then
+              echo "$output_name=true" >> "$GITHUB_OUTPUT"
+              return 0
+            else
+              echo "$output_name=false" >> "$GITHUB_OUTPUT"
+              return 1
+            fi
+          }
+
+          any=false
+
+          parse_checkbox "Hubs + ADX \(managed\)" "deploy-adx" && any=true
+          parse_checkbox "Hubs + Fabric \(manual\)" "deploy-fabric" && any=true
+          parse_checkbox "Hubs \(manual\)" "deploy-manual" && any=true
+          parse_checkbox "Hubs \(no data\)" "deploy-nodata" && any=true
+          parse_checkbox "Workbooks" "deploy-workbooks" && any=true
+          parse_checkbox "Alerts" "deploy-alerts" && any=true
+
+          echo "any-selected=$any" >> "$GITHUB_OUTPUT"


This workflow depends on PR-template checkboxes, but the current .github/PULL_REQUEST_TEMPLATE.md in the repo does not contain the referenced deployment options. As-is, any-selected will never become true and no deployments will run. Either include/update the PR template in this PR or ensure the checkbox text here matches the merged template exactly (and document the dependency).

This is a known dependency. We're holding the PR in a draft state until #2031 is complete.

.github/workflows/ftk-pr-cleanup.yml

.github/workflows/ftk-pr-deploy.yml

.github/workflows/ftk-pr-cleanup.yml

.github/workflows/ftk-pr-deploy.yml

@v2

- Fix PR body script injection: use env var instead of inline interpolation - Escape literal + in regex patterns for checkbox matching - Fix azure/login: use @v2 release tag instead of branch ref - Fix job name typo: "Hubs + (manual)" → "Hubs (manual)" - Remove unused any-selected output Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

- Tighten pull_request_target condition to only fire on Needs: Deployment label - Expand fork safety check to block src/scripts/ changes - Add Fabric URI validation before deploy (fails fast as first step) - Change cleanup trigger to pull_request_target for fork PR secret access - Add -ErrorAction Stop to Remove-AzResourceGroup for proper error handling - Fix assignee fallback for external contributors on cleanup failure issues 🤖 Generated with [Claude Code](https://claude.ai/claude-code) Co-Authored-By: Claude <noreply@anthropic.com>

flanakin · 2026-03-01T09:34:58Z

🤖 [AI][Claude] PR Update Summary

Addressed: 9 thread(s)

✅ Implemented: 6
🤔 Needs discussion: 3

Changes:

Tightened pull_request_target condition to only fire on Needs: Deployment label
Expanded fork safety check to also block src/scripts/ changes (security)
Added Fabric URI validation as first step in deploy-fabric job (fail fast)
Changed cleanup trigger to pull_request_target for fork PR secret access
Added -ErrorAction Stop to Remove-AzResourceGroup for proper try/catch behavior
Split issue creation and assignee into separate steps with fallback for external contributors

Push-backs (code already correct):

grep + escaping — patterns already use \+ which is correct in ERE
PR body injection — already using env: var, not inlined in shell
Deploy-Hub params dependency — known, covered by draft status

.github/workflows/ftk-pr-deploy.yml

- Fix fabric-uri script injection: pass via env var instead of direct interpolation - Add environment approval gate comment for fork PR security - Add timeout-minutes: 60 to all deployment jobs - Centralize Az module versions as workflow-level env vars - Cache Az modules in check-options, restore in deployment jobs - Update Deploy-Hub calls to use -PR {number} -Name "{variant}" 🤖 Generated with [Claude Code](https://claude.ai/claude-code) Co-Authored-By: RolandKrummenacher <RolandKrummenacher@users.noreply.github.com> Co-Authored-By: Claude <noreply@anthropic.com>

flanakin · 2026-03-04T09:22:03Z

🤖 [AI][Claude] PR Update Summary

Addressed: 5 thread(s)

✅ Implemented: 5

Fixed fabric-uri script injection — passed via env var instead of direct interpolation
Added environment approval gate comment for fork PR security (ftk-pr must have required reviewers)
Extracted Az module install to check-options with caching; deployment jobs restore from cache
Added timeout-minutes: 60 to all deployment jobs
Centralized Az module versions as workflow-level env vars

Also updated all Deploy-Hub calls to use -PR {number} -Name "{variant}" per PR #2030 changes.

flanakin requested a review from MSBrett as a code owner February 28, 2026 11:47

Copilot AI review requested due to automatic review settings February 28, 2026 11:47

Copilot started reviewing on behalf of flanakin February 28, 2026 11:48 View session

microsoft-github-policy-service bot added the Needs: Review 👀 PR that is ready to be reviewed label Feb 28, 2026

microsoft-github-policy-service bot assigned MSBrett Feb 28, 2026

microsoft-github-policy-service bot added the Skill: DevOps GitHub setup and automation label Feb 28, 2026

flanakin changed the title ~~Add per-PR deployment and cleanup workflows~~ [DevOps] PR Builds: PR deployment and cleanup workflows Feb 28, 2026

flanakin marked this pull request as draft February 28, 2026 11:49

Copilot AI reviewed Feb 28, 2026

View reviewed changes

flanakin and others added 2 commits February 28, 2026 22:19

flanakin added this to the v14 milestone Mar 2, 2026

RolandKrummenacher reviewed Mar 2, 2026

View reviewed changes

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

[DevOps] PR Builds: PR deployment and cleanup workflows#2033

[DevOps] PR Builds: PR deployment and cleanup workflows#2033
flanakin wants to merge 4 commits intodevfrom
flanakin/pr-deploy-workflows

flanakin commented Feb 28, 2026

Uh oh!

Copilot AI left a comment

Uh oh!

Copilot AI Feb 28, 2026

Uh oh!

flanakin Mar 1, 2026

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

flanakin commented Mar 1, 2026

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

flanakin commented Mar 4, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

Conversation

flanakin commented Feb 28, 2026

🛠️ Description

ftk-pr-deploy.yml

ftk-pr-cleanup.yml

Dependencies

📋 Checklist

🔬 How did you test this change?

🙋‍♀️ Do any of the following that apply?

📑 Did you update docs/changelog.md?

📖 Did you update documentation?

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Copilot AI Feb 28, 2026

Choose a reason for hiding this comment

Uh oh!

flanakin Mar 1, 2026

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

flanakin commented Mar 1, 2026

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

flanakin commented Mar 4, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

`ftk-pr-deploy.yml`

`ftk-pr-cleanup.yml`

📑 Did you update `docs/changelog.md`?