Deployment updates

.gitignore

@@ -344,3 +344,7 @@ appsettings.json
 
 # ignore local settings file that may contain secrets.
 /Solutions/Marain.Tenancy.Host.AspNetCore/appsettings.Development.json
+
+# Local build outputs
+_packages/
+*.sbom.*

Solutions/Marain.Tenancy.Deployment/Marain-PreDeploy.ps1

@@ -66,7 +66,7 @@ Function MarainDeployment([MarainServiceDeploymentContext] $ServiceDeploymentCon
 
             $ServiceDeploymentContext.InstanceContext.TenantAdminAppId = $newSp.$appIdPropertyName
             $ServiceDeploymentContext.InstanceContext.TenantAdminObjectId = $newSp.$objectIdPropertyName
-            Set-AzKeyVaultSecret -VaultName $keyVaultName -Name $tenantAdminSecretName -SecretValue $newSp.Secret | Out-Null
+            Set-AzKeyVaultSecret -VaultName $keyVaultName -Name $tenantAdminSecretName -SecretValue $newSp.SecretValue | Out-Null
         }
     }
     else {
@@ -80,7 +80,7 @@ Function MarainDeployment([MarainServiceDeploymentContext] $ServiceDeploymentCon
     if (!$tenantAdminSecret -and !$ServiceDeploymentContext.InstanceContext.DoNotUseGraph) {
         Write-Host "Resetting credential for default tenancy admnistrator service principal"
         $newSpCred = $existingSp | New-AzADServicePrincipalCredential
-        Set-AzKeyVaultSecret -VaultName $keyVaultName -Name $tenantAdminSecretName -SecretValue $newSpCred.Secret | Out-Null
+        Set-AzKeyVaultSecret -VaultName $keyVaultName -Name $tenantAdminSecretName -SecretValue (ConvertTo-SecureString $newSpCred.SecretText -AsPlainText) | Out-Null
         $tenantAdminSecret = Get-AzKeyVaultSecret -VaultName $keyVaultName -Name $tenantAdminSecretName
     }
     elseif (!$tenantAdminSecret) {

Solutions/Marain.Tenancy.Deployment/Templates/functions-app-settings.json

@@ -59,16 +59,17 @@
         "WEBSITE_RUN_FROM_PACKAGE": "[parameters('runFromPackage')]",
         "AzureConfigurationStorage": "[parameters('storageAccountConnectionString')]",
         "APPINSIGHTS_INSTRUMENTATIONKEY": "[parameters('applicationInsightsInstrumentationKey')]",
-        "FUNCTIONS_EXTENSION_VERSION": "~3",
+        "FUNCTIONS_EXTENSION_VERSION": "~4",
         "FUNCTIONS_WORKER_RUNTIME": "dotnet",
         "SubscriptionId": "[parameters('subscriptionId')]",
         "TenantId": "[parameters('tenantId')]",
         "AzureWebJobsDashboard": "[parameters('storageAccountConnectionString')]",
         "AzureWebJobsStorage": "[parameters('storageAccountConnectionString')]",
         "TenantCloudBlobContainerFactoryOptions:AzureServicesAuthConnectionString": "",
-        "RootTenantBlobStorageConfigurationOptions:AccountName": "[parameters('storageAccountName')]",
-        "RootTenantBlobStorageConfigurationOptions:KeyVaultName": "[parameters('keyVaultName')]",
-        "RootTenantBlobStorageConfigurationOptions:AccountKeySecretName": "[parameters('storageAccountKeyName')]",
+        "RootBlobStorageConfiguration:AccountName": "[parameters('storageAccountName')]",
+        "RootBlobStorageConfiguration:AccessKeyInKeyVault:VaultName": "[parameters('keyVaultName')]",
+        "RootBlobStorageConfiguration:AccessKeyInKeyVault:SecretName": "[parameters('storageAccountKeyName')]",
+        "RootBlobStorageConfiguration:AccessKeyInKeyVault:VaultClientIdentity:IdentitySourceType": "Managed",
         "TenantCacheConfiguration:GetTenantResponseCacheControlHeaderValue": "[parameters('tenantCacheControlHeaderValue')]"
       }
     }

azure-pipelines.yml

@@ -3,24 +3,47 @@ trigger:
     include:
     - master
     - main
-    - feature/*
   tags:
     include:
     - '*'
 
+parameters:
+- name: ForcePublish
+  type: boolean
+  default: false
+  displayName: When checked, a new release will be created and NuGet packages published; otherwise only 'master' branch changes will be published
+- name: InternalPublish
+  type: boolean
+  default: false
+  displayName: When checked, NuGet packages will be published to an internal feed; this is independent of whether a public release is performed
+- name: ForceRelease
+  type: boolean
+  default: false
+  displayName: When checked, a GitHub Release will be created but NuGet packages will not be published (unless other options are enabled)
+
 resources:
   repositories:
     - repository: recommended_practices
       type: github
       name: endjin/Endjin.RecommendedPractices.AzureDevopsPipelines.GitHub
       endpoint: marain-dotnet-github
 
+variables:
+  Endjin.ForcePublish: ${{ parameters.ForcePublish }}
+  Endjin.InternalPublish: ${{ parameters.InternalPublish }}
+  Endjin.ForceRelease: ${{ parameters.ForceRelease }}
+  # non-secret UI variables migrated to YAML
+  Endjin_Service_Connection_GitHub: marain-dotnet-github
+  Endjin_Service_Connection_NuGet_Org: marain-dotnet-nuget-org
+  TenantCacheConfiguration__GetTenantResponseCacheControlHeaderValue: max-age=300
+
 jobs:
 - template: templates/build.and.release.scripted.yml@recommended_practices
   parameters:
     vmImage: 'windows-latest'
     service_connection_nuget_org: $(Endjin_Service_Connection_NuGet_Org)
     service_connection_github: $(Endjin_Service_Connection_GitHub)
+    compileTasksServiceConnection: endjin-acr-reader
     postCustomEnvironmentVariables:
       - powershell: |
           Write-Host "##vso[task.setvariable variable=RootBlobStorageConfiguration__ConnectionStringPlainText]$Env:ENDJIN_AZURESTORAGECONNECTIONSTRING"

build.ps1

@@ -74,7 +74,7 @@ param (
     [version] $BuildModuleVersion = "1.1.1",
 
     [Parameter()]
-    [version] $InvokeBuildModuleVersion = "5.7.1"
+    [version] $InvokeBuildModuleVersion = "5.10.1"
 )
 
 $ErrorActionPreference = $ErrorActionPreference ? $ErrorActionPreference : 'Stop'
@@ -138,7 +138,8 @@ $SkipPublish = $false
 #
 $SolutionToBuild = (Resolve-Path (Join-Path $here ".\Solutions\Marain.Tenancy.sln")).Path
 $ProjectsToPublish = @(
-    # "Solutions/MySolution/MyWebSite/MyWebSite.csproj"
+    "Solutions/Marain.Tenancy.Host.AspNetCore/Marain.Tenancy.Host.AspNetCore.csproj"
+    "Solutions/Marain.Tenancy.Host.Functions/Marain.Tenancy.Host.Functions.csproj"
 )
 $NuSpecFilesToPackage = @(
     # "Solutions/MySolution/MyProject/MyProject.nuspec"