Visitar URL original
ci: migrate website deployment to GitHub Actions by BrendanWalsh · Pull Request #2505 · microsoft/SynapseML · GitHub
Skip to content

ci: migrate website deployment to GitHub Actions - #2505

Merged
Brendan Walsh (BrendanWalsh) merged 4 commits into
masterfrom
brwals/website-deploy-preview
Feb 14, 2026
Merged

ci: migrate website deployment to GitHub Actions#2505
Brendan Walsh (BrendanWalsh) merged 4 commits into
masterfrom
brwals/website-deploy-preview

Conversation

@BrendanWalsh

@BrendanWalsh Brendan Walsh (BrendanWalsh) commented Feb 14, 2026 •
edited
Loading

Copy link
Copy Markdown
Collaborator

Related Issues/PRs

Website deployment via ADO (WebsiteAutoDeployment job) fails with SAML SSO 403 errors on git push --force origin gh-pages. The PAT in mmlspark-keys Key Vault has lost SAML SSO authorization. This causes CI builds to show as failed even when all real tests pass.

What changes were made?

Migrates website deployment from ADO to GitHub Actions using actions/deploy-pages.

Added: .github/workflows/website-deploy.yml

  • On PRs: Builds the website and uploads as artifact for preview/validation
  • On master push: Builds the website and deploys to GitHub Pages via actions/deploy-pages
  • Triggers when docs/, website/, or tools/docgen/ change
  • Uses GITHUB_TOKEN — no PATs, no SAML SSO issues
  • ~9 min build (vs ~20 min in ADO)
  • concurrency groups cancel superseded builds
  • workflow_dispatch support for manual deploys
  • All action versions pinned to commit SHAs

Removed from pipeline.yaml

  • WebsiteAutoDeployment job (broken, 100% failure rate on CI builds)
  • websiteAutoDeploy parameter (no longer needed)

Validated output

Compared the GH Actions build output against the current live site (gh-pages branch):

  • 1,900 HTML pages: ✅ All identical
  • 27 static files (CSS/images): ✅ All identical
  • JS bundles: Different hashes (expected from Webpack rebundling)
  • Only structural diff: .nojekyll file (not needed for Actions deploys)

Post-merge step

Change Pages source to GitHub Actions:

gh api repos/microsoft/SynapseML/pages -X PUT -f build_type=workflow

The gh-pages branch remains as rollback if needed.

How is this tested?

  • ✅ Full build tested locally and in CI (9 min)
  • ✅ Byte-for-byte comparison against live site — identical output
  • ✅ CI passes on all checks

Does this PR introduce a breaking change?

No. Website deployment won't activate until the Pages source setting is changed post-merge.

@BrendanWalsh
ci: add website preview build workflow
5bf9816 
Phase 1 of website deployment migration from ADO to GitHub Actions.
Builds the website on pushes to master (when docs/website/docgen change)
and uploads the result as an artifact for validation.

Does NOT deploy to GitHub Pages yet — just validates the build pipeline
works correctly on GH Actions before switching over.
@github-actions

github-actions Bot commented Feb 14, 2026

Copy link
Copy Markdown

Hey Brendan Walsh (@BrendanWalsh) 👋!
Thank you so much for contributing to our repository 🙌.
Someone from SynapseML Team will be reviewing this pull request soon.

We use semantic commit messages to streamline the release process.
Before your pull request can be merged, you should make sure your first commit and PR title start with a semantic prefix.
This helps us to create release messages and credit you for your hard work!

Examples of commit messages with semantic prefixes:

  • fix: Fix LightGBM crashes with empty partitions
  • feat: Make HTTP on Spark back-offs configurable
  • docs: Update Spark Serving usage
  • build: Add codecov support
  • perf: improve LightGBM memory usage
  • refactor: make python code generation rely on classes
  • style: Remove nulls from CNTKModel
  • test: Add test coverage for CNTKModel

To test your commit locally, please follow our guild on building from source.
Check out the developer guide for additional guidance on testing your change.

@github-actions

github-actions Bot commented Feb 14, 2026 •
edited
Loading

Copy link
Copy Markdown

Dependency Review

✅ No vulnerabilities or license issues or OpenSSF Scorecard issues found.

OpenSSF Scorecard

PackageVersionScoreDetails
actions/actions/checkout 11bd71901bbe5b1630ceea73d27597364c9af683 🟢 6.5
Details
CheckScoreReason
Code-Review🟢 10all changesets reviewed
Maintained🟢 57 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 5
Binary-Artifacts🟢 10no binaries found in the repo
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
Token-Permissions⚠️ 0detected GitHub workflow tokens with excessive permissions
CII-Best-Practices⚠️ 0no effort to earn an OpenSSF best practices badge detected
Packaging⚠️ -1packaging workflow not detected
Fuzzing⚠️ 0project is not fuzzed
License🟢 10license file detected
Pinned-Dependencies🟢 3dependency not pinned by hash detected -- score normalized to 3
Signed-Releases⚠️ -1no releases found
Security-Policy🟢 9security policy file detected
Branch-Protection🟢 6branch protection is not maximal on development and all release branches
Vulnerabilities🟢 82 existing vulnerabilities detected
SAST🟢 8SAST tool detected but not run on all commits
actions/actions/configure-pages 983d7736d9b0ae728b81ab479565c72886d7745b 🟢 5.6
Details
CheckScoreReason
Maintained⚠️ 00 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 0
Packaging⚠️ -1packaging workflow not detected
Code-Review🟢 10all changesets reviewed
Binary-Artifacts🟢 10no binaries found in the repo
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
Token-Permissions⚠️ 0detected GitHub workflow tokens with excessive permissions
CII-Best-Practices⚠️ 0no effort to earn an OpenSSF best practices badge detected
Pinned-Dependencies🟢 6dependency not pinned by hash detected -- score normalized to 6
License🟢 10license file detected
Signed-Releases⚠️ -1no releases found
Fuzzing⚠️ 0project is not fuzzed
Security-Policy🟢 9security policy file detected
Vulnerabilities⚠️ 012 existing vulnerabilities detected
SAST🟢 7SAST tool detected but not run on all commits
Branch-Protection🟢 8branch protection is not maximal on development and all release branches
actions/actions/deploy-pages d6db90164ac5ed86f2b6aed7e0febac5b3c0c03e 🟢 4.9
Details
CheckScoreReason
Code-Review🟢 10all changesets reviewed
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
Maintained⚠️ 00 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 0
Binary-Artifacts🟢 10no binaries found in the repo
Packaging⚠️ -1packaging workflow not detected
CII-Best-Practices⚠️ 0no effort to earn an OpenSSF best practices badge detected
Token-Permissions⚠️ 0detected GitHub workflow tokens with excessive permissions
License🟢 10license file detected
Pinned-Dependencies🟢 6dependency not pinned by hash detected -- score normalized to 6
Signed-Releases⚠️ -1no releases found
Security-Policy🟢 9security policy file detected
Fuzzing⚠️ 0project is not fuzzed
SAST🟢 7SAST tool detected but not run on all commits
Vulnerabilities⚠️ 020 existing vulnerabilities detected
Branch-Protection⚠️ 1branch protection is not maximal on development and all release branches
actions/actions/setup-node 49933ea5288caeca8642d1e84afbd3f7d6820020 🟢 6
Details
CheckScoreReason
Maintained🟢 911 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 9
Packaging⚠️ -1packaging workflow not detected
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
Binary-Artifacts🟢 9binaries present in source code
Code-Review🟢 10all changesets reviewed
CII-Best-Practices⚠️ 0no effort to earn an OpenSSF best practices badge detected
Token-Permissions⚠️ 0detected GitHub workflow tokens with excessive permissions
Pinned-Dependencies⚠️ 0dependency not pinned by hash detected -- score normalized to 0
Fuzzing⚠️ 0project is not fuzzed
License🟢 10license file detected
Signed-Releases⚠️ -1no releases found
Security-Policy🟢 9security policy file detected
Branch-Protection⚠️ 1branch protection is not maximal on development and all release branches
Vulnerabilities🟢 64 existing vulnerabilities detected
SAST🟢 9SAST tool is not run on all commits -- score normalized to 9
actions/actions/setup-python a26af69be951a213d495a4c3e4e4022e16d87065 🟢 5.1
Details
CheckScoreReason
Code-Review🟢 10all changesets reviewed
Maintained🟢 56 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 5
CII-Best-Practices⚠️ 0no effort to earn an OpenSSF best practices badge detected
Binary-Artifacts🟢 10no binaries found in the repo
License🟢 10license file detected
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
Packaging⚠️ -1packaging workflow not detected
Fuzzing⚠️ 0project is not fuzzed
Token-Permissions⚠️ 0detected GitHub workflow tokens with excessive permissions
Pinned-Dependencies⚠️ 0dependency not pinned by hash detected -- score normalized to 0
Signed-Releases⚠️ -1no releases found
Security-Policy🟢 9security policy file detected
Vulnerabilities⚠️ 19 existing vulnerabilities detected
Branch-Protection⚠️ 0branch protection not enabled on development/release branches
SAST🟢 9SAST tool is not run on all commits -- score normalized to 9
actions/actions/upload-artifact ea165f8d65b6e75b540449e92b4886f43607fa02 🟢 6.3
Details
CheckScoreReason
Code-Review🟢 10all changesets reviewed
Binary-Artifacts🟢 10no binaries found in the repo
Packaging⚠️ -1packaging workflow not detected
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
Maintained🟢 1027 commit(s) and 1 issue activity found in the last 90 days -- score normalized to 10
CII-Best-Practices⚠️ 0no effort to earn an OpenSSF best practices badge detected
Token-Permissions⚠️ 0detected GitHub workflow tokens with excessive permissions
License🟢 10license file detected
Fuzzing⚠️ 0project is not fuzzed
Pinned-Dependencies⚠️ 1dependency not pinned by hash detected -- score normalized to 1
Signed-Releases⚠️ -1no releases found
Security-Policy🟢 9security policy file detected
Branch-Protection⚠️ 0branch protection not enabled on development/release branches
SAST🟢 10SAST tool is run on all commits
Vulnerabilities🟢 73 existing vulnerabilities detected
actions/actions/upload-pages-artifact 56afc609e74202658d3ffba0e8f6dda462b719fa 🟢 5.8
Details
CheckScoreReason
Maintained⚠️ 00 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 0
Packaging⚠️ -1packaging workflow not detected
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
Binary-Artifacts🟢 10no binaries found in the repo
Code-Review🟢 8Found 8/9 approved changesets -- score normalized to 8
Pinned-Dependencies🟢 4dependency not pinned by hash detected -- score normalized to 4
Token-Permissions⚠️ 0detected GitHub workflow tokens with excessive permissions
CII-Best-Practices⚠️ 0no effort to earn an OpenSSF best practices badge detected
Vulnerabilities🟢 100 existing vulnerabilities detected
Fuzzing⚠️ 0project is not fuzzed
License🟢 10license file detected
Signed-Releases⚠️ -1no releases found
Security-Policy🟢 9security policy file detected
SAST⚠️ 0SAST tool is not run on all commits -- score normalized to 0
Branch-Protection🟢 8branch protection is not maximal on development and all release branches

Scanned Files

  • .github/workflows/website-deploy.yml

@BrendanWalsh Brendan Walsh (BrendanWalsh) changed the title ci: add website preview build workflow (Phase 1) ci: migrate website deployment to GitHub Actions Feb 14, 2026
@BrendanWalsh
ci: add GitHub Pages deployment via actions/deploy-pages
95e8623 
- On PRs: build only, upload artifact for preview
- On master push: build + deploy to GitHub Pages
- Replaces broken ADO WebsiteAutoDeployment (SAML SSO 403)
- Uses GITHUB_TOKEN (no PATs, no SAML issues)
- Requires Pages source set to 'GitHub Actions' in repo settings
@BrendanWalsh
Brendan Walsh (BrendanWalsh) merged commit 5d4a3ef into master Feb 14, 2026
13 checks passed
@BrendanWalsh
Brendan Walsh (BrendanWalsh) deleted the brwals/website-deploy-preview branch February 14, 2026 08:17
@BrendanWalsh Brendan Walsh (BrendanWalsh) mentioned this pull request Aug 12, 2026
Merged
3 tasks done
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@BrendanWalsh