Skip to content

CHANGELOG.md

Latest commit

 

History

History
63 lines (44 loc) · 3.34 KB

CHANGELOG.md

File metadata and controls

63 lines (44 loc) · 3.34 KB
Raw

Changelog

All notable changes to Vigil will be documented in this file.

The format follows Keep a Changelog. Vigil uses Semantic Versioning.

Unreleased

Fixed

  • Terraform: replaced storage_uses_managed_identity = true with storage_account_access_key on the Function App runtime storage. Kudu (Azure's deployment engine) cannot acquire managed identity tokens in its sandboxed container, causing Malformed SCM_RUN_FROM_PACKAGE errors during zip deploy on Linux Consumption plans.
  • Terraform: set SCM_DO_BUILD_DURING_DEPLOYMENT and ENABLE_ORYX_BUILD to false in app settings. Previously hardcoded to true, which conflicted with the CI/CD workflow's pre-built package approach and caused those settings to revert to true after every function restart.

0.1.0 — 2026-03-27

Initial public release.

Added

Core monitoring

  • Timer-triggered Azure Function that fetches Synapse pipeline runs for a configurable lookback window (HOURS_BACK, default 24 h)
  • Pagination support for workspaces with large numbers of pipeline runs
  • Duration calculation for completed and in-progress runs

Reporting

  • HTML email report delivered via Azure Communication Services, showing a summary table of succeeded, failed, and in-progress runs with per-pipeline detail
  • Configurable schedule via MONITOR_SCHEDULE CRON expression (default: 06:00 and 08:00 UTC daily)
  • Configurable recipient list, sender address, and timezone

Archiving

  • Daily CSV snapshot of all pipeline runs uploaded to Azure Blob Storage (BLOB_STORAGE_ACCOUNT_URL)
  • Local filesystem fallback when running in development (AZURE_FUNCTIONS_ENVIRONMENT=Development)
  • Exponential backoff retry (3 attempts) on transient blob upload failures

Security

  • Managed identity authentication throughout — Synapse, Blob Storage, and Azure Communication Services require no stored credentials
  • Least-privilege RBAC: Synapse Monitoring Operator for Synapse, Storage Blob Data Contributor for archive storage, Azure Communication Service Email Sender for ACS
  • Deploy workflow uses a production GitHub environment and scoped publish-profile secret; OIDC migration path is pre-enabled via id-token: write

Infrastructure

  • Terraform IaC for the Vigil Function App stack: runtime storage account, Linux Consumption plan, Function App, managed identity, app settings, and deployment outputs
  • Azure prerequisites (Synapse workspace, ACS, reports storage, App Insights/Log Analytics, RBAC assignments) documented in AZURE_SETUP.md

CI/CD

  • GitHub Actions workflow: lint (ruff), test (pytest), deploy to Azure Functions on push to main
  • Deploy job gated on production GitHub Environment with manual approval support
  • All third-party Actions pinned to full commit SHAs

Observability

  • Structured logging with custom_dimensions forwarded to Application Insights
  • Explicit startup log indicating local vs production archive mode

Testing

  • Pytest test suite covering config validation, email generation, archive routing, retry logic, monitor pagination, and function orchestrator control flow
  • Shared fixtures in tests/conftest.py