CI/CD, policy as code, and controlled promotion

Chapter 5 of 6

Implement#

1. Complete the definitions and run decision preflight#

Set the JSON values, parameter files, workflow paths, full action SHAs, and fixed versions. Then run:

.\scripts\preflight.ps1 `
  -Phase Decisions `
  -ApprovedNonproductionScope "/subscriptions/<id>/resourceGroups/<name>" `
  -ApprovedProductionScope "/subscriptions/<id>/resourceGroups/<name>" `
  -ApprovedReleaseSha "<40-character-release-sha>"

./scripts/preflight.sh \
  --phase decisions \
  --approved-nonproduction-scope "/subscriptions/<id>/resourceGroups/<name>" \
  --approved-production-scope "/subscriptions/<id>/resourceGroups/<name>" \
  --approved-release-sha "<40-character-release-sha>"

This read-only phase checks unresolved decisions, repository lineage, workflow structure, fixed versions, action pins, source paths, the framework and duplicate-review decisions, JSON, Bicep lint, and Bicep build.

2. Confirm the administrative gates#

The GitHub and Entra administrators confirm the four environment protections and OIDC trusts, the two exact Contributor assignments, environment variables, native secret controls, and absence of Azure client secrets. Stop if the repository plan cannot expose a required protection.

3. Run ready preflight#

Use the approved release/security-store interface to retrieve the evaluation baseline and candidate records and the security attestation into the approved temporary workspace. Pass their absolute paths:

.\scripts\preflight.ps1 `
  -Phase Ready `
  -ApprovedNonproductionScope "/subscriptions/<id>/resourceGroups/<name>" `
  -ApprovedProductionScope "/subscriptions/<id>/resourceGroups/<name>" `
  -ApprovedReleaseSha "<40-character-release-sha>" `
  -BaselineRecordPath "<temporary-session09-baseline-result.json>" `
  -CandidateRecordPath "<temporary-session09-candidate-result.json>" `
  -SecurityReleaseAttestationPath "<temporary-session10-attestation.json>"

./scripts/preflight.sh \
  --phase ready \
  --approved-nonproduction-scope "/subscriptions/<id>/resourceGroups/<name>" \
  --approved-production-scope "/subscriptions/<id>/resourceGroups/<name>" \
  --approved-release-sha "<40-character-release-sha>" \
  --baseline-record-path "<temporary-session09-baseline-result.json>" \
  --candidate-record-path "<temporary-session09-candidate-result.json>" \
  --security-release-attestation-path "<temporary-session10-attestation.json>"

Ready repeats the local checks, reads GitHub and Entra configuration, verifies both role scopes, and runs both Bicep what-if operations. It rejects repository paths and files outside the approved temporary workspace. It changes no resources.

The platform owner approves both previews. Stop on any unexplained result.

4. Run the permitted promotion#

Install the reviewed promotion and restore workflows through the normal repository change path before live delivery. Dispatch Controlled AI release promotion with the approved release_sha and evaluation_record=candidate.

The workflow:

1. proves the SHA belongs to the protected default branch, checks it out, and rechecks the workflow, pins, fixed digests, secret controls, the framework path and duplicate review, unit result, evaluation gate and security attestation;
2. runs the generated blocked-tool-process self-test before Azure;
3. runs nonproduction what-if, waits for nonproduction approval, deploys, and runs smoke check;
4. rechecks digests, runs production what-if, waits for production approval, and deploys the same release; and
5. stages the release record, moves the approved selector, then approves the record. If finalization fails, leave the record staged and use the approved restore workflow.