From b01eeee5e622a925c0a0bf7e03b531e717a58165 Mon Sep 17 00:00:00 2001 From: Rael Garcia Date: Mon, 3 Aug 2026 16:42:47 +0000 Subject: [PATCH] fix(dev-infrastructure): unset workingDir on postgres-access reconcile steps (AROSLSRE-1699) cs-postgres-access and maestro-postgres-access enforce postgres access grants and must run on every incremental rollout. Setting workingDir opts a Shell step into content-hash caching (IsWellFormedOverInputs() in ARO-Tools/pipelines/types/shell.go returns true whenever workingDir is non-empty), so these reconcile steps could be silently skipped when their cached command/workingDir/envVars are unchanged. Since both pipeline.yaml files live at the repo root of dev-infrastructure/, removing workingDir doesn't change the step's actual working directory (it already resolved to the pipeline directory), it only makes the step always re-run in incremental mode as intended. Raised by roivaz in https://github.com/Azure/ARO-HCP/pull/6369#discussion_r3705131376 Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> --- dev-infrastructure/svc-pipeline.yaml | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-) diff --git a/dev-infrastructure/svc-pipeline.yaml b/dev-infrastructure/svc-pipeline.yaml index c85e548d94d..37912e9658e 100644 --- a/dev-infrastructure/svc-pipeline.yaml +++ b/dev-infrastructure/svc-pipeline.yaml @@ -504,7 +504,9 @@ resourceGroups: - name: cs-postgres-access action: Shell command: ./scripts/postgres-access/postgres-access - workingDir: . + # workingDir intentionally left unset: this step reconciles postgres access grants and + # must always run on incremental rollouts, not be skipped by content-hash caching, which + # setting workingDir would opt it into (see AROSLSRE-1699). shellIdentity: input: resourceGroup: global @@ -538,7 +540,9 @@ resourceGroups: - name: maestro-postgres-access action: Shell command: ./scripts/postgres-access/postgres-access - workingDir: . + # workingDir intentionally left unset: this step reconciles postgres access grants and + # must always run on incremental rollouts, not be skipped by content-hash caching, which + # setting workingDir would opt it into (see AROSLSRE-1699). shellIdentity: input: resourceGroup: global