[amren1502129]

This pull request updates the infrastructure and deployment scripts to support newer versions of dependencies, upgrades the .NET runtime for all web apps to .NET 10.0, and improves deployment automation and configuration handling. The changes also ensure compatibility with newer Terraform and AzureRM provider versions, and streamline how storage and dashboard resources are defined.

Key changes include:

Platform and Dependency Upgrades

• Upgraded the required Terraform version to 1.15.8 and the AzureRM provider to 4.x in all relevant azure.tf files, ensuring support for newer features and improved compatibility. [1] [2] [3]
• Updated the dotnet_version for all Azure Windows Web Apps and slots (including fulfilment and mock API webapps) from v8.0 to v10.0, both in Terraform modules and in deployment scripts, to run on the latest .NET runtime. [1] [2] [3] [4] [5] [6] [7] [8] [9] [10] [11]

Infrastructure Resource Improvements

• Changed storage resource definitions to use storage_account_id instead of storage_account_name for better alignment with Azure best practices and improved resource referencing.
• Updated the dashboard resource from azurerm_dashboard to azurerm_portal_dashboard to use the current Azure provider resource type.
• Set rbac_authorization_enabled = false in the Key Vault resource for explicit configuration.

Deployment Pipeline and Automation Enhancements

• Added Azure CLI deployment steps in both continuous-deployment.yml and continuous-deployment-v2.yml to explicitly set the windows_fx_version for all webapps and their slots to .NET 10.0, ensuring runtime consistency post-deployment. [1] [2]
• Introduced a new pipeline template fulfilment-webapp-az.yml to standardize webjob deployment and configuration through parameterized steps.

Terraform and Script Improvements

• Added the -upgrade flag to all terraform init commands in deployment scripts to ensure modules and providers are updated during initialization. [1] [2] [3] [4]
• Enhanced output handling in deployment scripts to export environment variables for all fulfilment webapp sizes, improving downstream script and pipeline integration. [1] [2]

[snyk-io-eu]

✅ Snyk checks have passed. No issues have been found so far.

Status	Scan Engine	Critical	High	Medium	Low	Total (0)
✅	Open Source Security	0	0	0	0	0 issues
✅	Licenses	0	0	0	0	0 issues
✅	Code Security	0	0	0	0	0 issues

💻 Catch issues earlier using the plugins for VS Code, JetBrains IDEs, Visual Studio, and Eclipse.

[MuhammadJawad-Mastek]

Its looking good to approve

[mattwin1]

LGTM

[Copilot]

Pull request overview

This PR upgrades services and deployment infrastructure to .NET 10, Terraform 1.15.8, and AzureRM 4.x.

Changes:

• Updates application projects, dependencies, and Azure runtimes.
• Modernizes Terraform resources and storage/dashboard configuration.
• Enhances deployment automation and log sanitization.

Reviewed changes

Copilot reviewed 29 out of 31 changed files in this pull request and generated 12 comments.

Show a summary per file

File	Description
UKHO.SalesCatalogueFileShareServicesMock.API/UKHO.SalesCatalogueFileShareServicesMock.API/UKHO.SalesCatalogueFileShareServicesMock.API.csproj	Updates the mock API to .NET 10.
UKHO.ExchangeSetService.API/UKHO.ExchangeSetService.Webjob.UnitTests/UKHO.ExchangeSetService.Webjob.UnitTests.csproj	Updates webjob tests and dependencies.
UKHO.ExchangeSetService.API/UKHO.ExchangeSetService.FulfilmentService/UKHO.ExchangeSetService.FulfilmentService.csproj	Updates fulfilment runtime and packages.
UKHO.ExchangeSetService.API/UKHO.ExchangeSetService.Common/UKHO.ExchangeSetService.Common.csproj	Updates common runtime and dependencies.
UKHO.ExchangeSetService.API/UKHO.ExchangeSetService.Common/Helpers/CommonHelper.cs	Adds log-input sanitization.
UKHO.ExchangeSetService.API/UKHO.ExchangeSetService.Common/HealthCheck/AzureWebJobsHealthCheck.cs	Sanitizes health-check logging.
UKHO.ExchangeSetService.API/UKHO.ExchangeSetService.Common.UnitTests/UKHO.ExchangeSetService.Common.UnitTests.csproj	Updates common tests to .NET 10.
UKHO.ExchangeSetService.API/UKHO.ExchangeSetService.API/UKHO.ExchangeSetService.API.csproj	Updates API runtime and dependencies.
UKHO.ExchangeSetService.API/UKHO.ExchangeSetService.API/Filters/SecurityRequirementsOperationFilter.cs	Formatting cleanup.
UKHO.ExchangeSetService.API/UKHO.ExchangeSetService.API/Filters/LoggingMiddleware.cs	Sanitizes logged headers.
UKHO.ExchangeSetService.API/UKHO.ExchangeSetService.API/Controllers/ProductDataController.cs	Import and formatting cleanup.
UKHO.ExchangeSetService.API/UKHO.ExchangeSetService.API.UnitTests/UKHO.ExchangeSetService.API.UnitTests.csproj	Updates API tests.
UKHO.ExchangeSetService.API/UKHO.ExchangeSetService.API.FunctionalTests/UKHO.ExchangeSetService.API.FunctionalTests.csproj	Updates functional tests and dependencies.
MockApiDeployment/src/Modules/Webapp/main.tf	Configures mock web apps for .NET 10.
MockApiDeployment/src/azure.tf	Upgrades Terraform and AzureRM.
Deployment/terraform_conditional_run.ps1	Updates Terraform initialization and deployment outputs.
Deployment/terraform_conditional_run_v2.ps1	Updates v2 Terraform initialization and outputs.
Deployment/terraform_conditional_run_apim.ps1	Updates APIM Terraform initialization.
Deployment/terraform_conditional_run_apim_v2.ps1	Updates v2 APIM initialization.
Deployment/templates/fulfilment-webapp-az.yml	Adds a fulfilment deployment template.
Deployment/templates/continuous-deployment.yml	Adds runtime configuration deployment steps.
Deployment/templates/continuous-deployment-v2.yml	Adds v2 runtime configuration deployment steps.
Deployment/src/outputs.tf	Maintains Terraform outputs.
Deployment/src/Modules/Webapp/main.tf	Configures web apps for .NET 10.
Deployment/src/Modules/KeyVault/main.tf	Explicitly configures Key Vault RBAC.
Deployment/src/Modules/FulfilmentWebapps/main.tf	Configures fulfilment apps and slots for .NET 10.
Deployment/src/Modules/FulfilmentStorage/main.tf	Migrates selected storage resources to account IDs.
Deployment/src/Modules/azuredashboard/main.tf	Switches to the portal dashboard resource.
Deployment/src/Modules/APIM/azure.tf	Updates APIM AzureRM configuration.
Deployment/src/azure.tf	Upgrades Terraform and AzureRM.
azure-pipelines.yml	Updates Terraform and .NET SDK versions.

Suppressed comments (4)

Deployment/templates/continuous-deployment-v2.yml:61

• The added az webapp config set calls do not check their exit status, and AzureCLI does not fail on stderr by default. If one of the many runtime updates fails, later successful commands can leave the task green while that app remains on the old runtime. Fail immediately or explicitly check $LASTEXITCODE after each call.

        az webapp config set `
         --resource-group $rg `
         --name "$env:WEB_APP_NAME" `
         --slot "$env:WEB_APP_SLOT_NAME" `
         --windows-fx-version "DOTNET|10.0"

Deployment/templates/continuous-deployment.yml:61

• The added az webapp config set calls do not check their exit status, and AzureCLI does not fail on stderr by default. If one of the many runtime updates fails, later successful commands can leave the task green while that app remains on the old runtime. Fail immediately or explicitly check $LASTEXITCODE after each call.

        az webapp config set `
         --resource-group $rg `
         --name "$env:WEBAPPNAME" `
         --slot "$env:WEB_APP_SLOT_NAME" `
         --windows-fx-version "DOTNET|10.0"

UKHO.ExchangeSetService.API/UKHO.ExchangeSetService.API/Filters/LoggingMiddleware.cs:171

• Sanitizing only header names and values does not protect the other request-controlled values logged by this middleware, such as the URL, request body, and response body. Those values are still written directly in the log call, so CR/LF input can continue to forge log records. Apply the same normalization to all untrusted log fields or use a sink that escapes them.

                .ToDictionary(h => CommonHelper.SanitizeLogInput(h.Key), h => HeadersToRedact.Any(r => r.Equals(h.Key, StringComparison.InvariantCultureIgnoreCase)) ? RedactedValue : CommonHelper.SanitizeLogInput(string.Join(", ", (object[])h.Value)));

UKHO.ExchangeSetService.API/UKHO.ExchangeSetService.Common/Helpers/CommonHelper.cs:69

• CommonHelperTest covers the other helper methods, but no test was added for this new log-sanitization boundary. Add focused cases for empty input and embedded carriage-return/newline characters so the log-forging protection cannot regress unnoticed.

        public static string SanitizeLogInput(string input)
        {
            if (string.IsNullOrEmpty(input))
                return string.Empty;

            // Remove newlines and carriage returns to prevent log forging
            return input.Replace("\r", string.Empty).Replace("\n", string.Empty);

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[ganpat-tech]

Look Good to me

[MuhammadJawad-Mastek]

Its looking good to approve.