test(ci): exercise multi-deployment PR check

.github/workflows/ado/package-build.yml

@@ -36,15 +36,15 @@
 # Variable Group (ADO Pipelines > Library):
 #   Name: "ControlTower-PRCheck"
 #   Required variables:
-#     - ApiAudience          : Entra ID audience URI for the Control Tower app
-#     - ApiBaseAFDUrl        : Base URL of the Control Tower service (Azure Front Door endpoint)
+#     - ApiAudienceDev      : DEV Entra ID audience URI
+#     - ApiBaseAFDUrlDev    : DEV Azure Front Door endpoint base URL
 
 # Trigger controlled by ADO branch policy — not YAML triggers.
 trigger: none
 
 pr: none
 
-# Variables extracted from this group: ApiAudience, ApiBaseAFDUrl.
+# Variables extracted from this group: ApiAudienceDev, ApiBaseAFDUrlDev.
 variables:
   - group: ControlTower-PRCheck
 
@@ -78,8 +78,8 @@ extends:
     stages:
       - template: /.github/workflows/ado/templates/package-build-stages.yml@self
         parameters:
-          apiAudience: $(ApiAudience)
-          apiBaseAFDUrl: $(ApiBaseAFDUrl)
+          apiAudience: $(ApiAudienceDev)
+          apiBaseAFDUrl: $(ApiBaseAFDUrlDev)
           artifactBaseName: packagebuild
           containerImage: mcr.microsoft.com/onebranch/azurelinux/build:3.0
           outputDirectory: $(Build.ArtifactStagingDirectory)/output

.github/workflows/ado/pr-check-ct.yml

@@ -2,12 +2,14 @@
 # Licensed under the MIT License.
 #
 # Wrapper pipeline — passed to ADO as the entry point for the PR Control Tower
-# check. It calls Control Tower 'prcheck' (which uploads the changed
-# components' missing lookaside sources) and then submits a *scratch* Control
-# Tower build of those components, WAITS for that build to finish, and fails
-# the check if the build fails (or is rejected). The package build runs in
-# Control Tower's own sandbox; checkout-controlled pipeline helpers still run
-# on the CI agent under the configured service connection.
+# check. For each configured deployment, it calls Control Tower 'prcheck'
+# (which uploads the changed components' missing lookaside sources). DEV then
+# submits a *scratch* Control Tower build of those components and WAITS for it
+# to finish; STAGING and PROD skip package builds. DEV and PROD API failures
+# fail the check, while STAGING prcheck failures are non-blocking. Deployment
+# jobs run independently in parallel. Package builds run in Control Tower's own
+# sandbox; checkout-controlled pipeline helpers still run on CI agents under
+# the deployment-specific service connections.
 #
 # This file owns all OneBranch-specific wiring (governed templates repo,
 # NonOfficial variant, featureFlags) and delegates the actual stages/jobs/steps
@@ -21,23 +23,22 @@
 # gate: this pipeline does NOT auto-run on every PR push, and a maintainer
 # triggers it only after inspecting the diff. See the prerequisite below.
 #
-# NonOfficial: this is PR validation. It calls the Control Tower DEV endpoint
-# (via the DEV service connection) and produces only scratch builds; it is not
-# a production-classified pipeline.
+# TEST-ONLY OVERRIDE: use NonOfficial governance while validating this pipeline
+# from the temporary draft PR. Do not merge this override into the 4.0 branch.
 #
 # Helper scripts live under:
 # - scripts/ci/control-tower/ - (Control Tower client + submit script).
 # - scripts/ci/components/ - cross-pipeline azldev change-set helpers (shared
 #   with the GitHub Actions PR gates and the Control Tower pipelines).
 #
 # Prerequisites (ADO / Azure Portal):
-#   1. Entra ID App Registration with audience URI
+#   1. Entra ID App Registrations with audience URIs
 #      "api://<ControlTower-ClientId>" (see variable group below).
-#   2. Federated identity credential on the app registration for the ADO
-#      service connection (issuer: https://vstoken.dev.azure.com/<org-id>,
+#   2. Federated identity credentials on the app registrations for the ADO
+#      service connections (issuer: https://vstoken.dev.azure.com/<org-id>,
 #      subject: sc://<org>/<project>/<service-connection-name>).
-#   3. ARM service connection in ADO project settings using Workload Identity
-#      Federation (manual).
+#   3. DEV, STAGING, and PROD ARM service connections in ADO project settings
+#      using Workload Identity Federation (manual).
 #   4. REVIEWER-GATED trigger (configured in ADO, not here): wire this pipeline
 #      as a build-validation check that does NOT automatically queue on every
 #      PR push (e.g. an optional/manual build-validation policy, or a manual
@@ -46,15 +47,19 @@
 # Variable Group (ADO Pipelines > Library):
 #   Name: "ControlTower-PRCheck"
 #   Required variables:
-#     - ApiAudience          : Entra ID audience URI for the Control Tower app
-#     - ApiBaseAFDUrl        : Base URL of the Control Tower service (Azure Front Door endpoint)
+#     - ApiAudienceDev        : DEV Entra ID audience URI
+#     - ApiAudienceStaging    : STAGING Entra ID audience URI
+#     - ApiAudienceProd       : PROD Entra ID audience URI
+#     - ApiBaseAFDUrlDev      : DEV Azure Front Door endpoint base URL
+#     - ApiBaseAFDUrlStaging  : STAGING Azure Front Door endpoint base URL
+#     - ApiBaseAFDUrlProd     : PROD Azure Front Door endpoint base URL
 
 # Trigger controlled by ADO branch policy — not YAML triggers.
 trigger: none
 
 pr: none
 
-# Variables extracted from this group: ApiAudience, ApiBaseAFDUrl.
+# Variables extracted from this group: deployment audiences and endpoint URLs.
 variables:
   - group: ControlTower-PRCheck
 
@@ -88,10 +93,27 @@ extends:
     stages:
       - template: /.github/workflows/ado/templates/pr-check-ct-stages.yml@self
         parameters:
-          apiAudience: $(ApiAudience)
-          apiBaseAFDUrl: $(ApiBaseAFDUrl)
           artifactBaseName: prcheckct
           containerImage: mcr.microsoft.com/onebranch/azurelinux/build:3.0
+          deployments:
+            DEV:
+              apiAudience: $(ApiAudienceDev)
+              apiBaseAFDUrl: $(ApiBaseAFDUrlDev)
+              continueOnError: false
+              serviceConnection: CT-Endpoints-Access-ServiceConnection-DEV
+              skipPackageBuilds: false
+            STAGING:
+              apiAudience: $(ApiAudienceStaging)
+              apiBaseAFDUrl: $(ApiBaseAFDUrlStaging)
+              continueOnError: true
+              serviceConnection: CT-Endpoints-Access-ServiceConnection-STAGING
+              skipPackageBuilds: true
+            PROD:
+              apiAudience: $(ApiAudienceProd)
+              apiBaseAFDUrl: $(ApiBaseAFDUrlProd)
+              continueOnError: false
+              serviceConnection: CT-Endpoints-Access-ServiceConnection-PROD
+              skipPackageBuilds: true
           outputDirectory: $(Build.ArtifactStagingDirectory)/output
           # Distro-config RPM build-environment for the 4.0 branch.
           packageEnvironment: "4.0"
@@ -103,5 +125,4 @@ extends:
           # Raise both together if a legitimate build is being killed.
           pollTimeoutSeconds: 21600
           poolType: linux
-          serviceConnection: CT-Endpoints-Access-ServiceConnection-DEV
           timeoutInMinutes: 420

.github/workflows/ado/templates/package-build-stages.yml

@@ -89,6 +89,8 @@ stages:
               API_BASE_URL: ${{ parameters.apiBaseAFDUrl }}
               CHANGED_COMPONENTS_FILE: $(changedComponentsFile)
               PACKAGE_ENVIRONMENT: $(packageEnvironment)
+              # Secret predefined variables are not auto-exposed.
+              SYSTEM_ACCESSTOKEN: $(System.AccessToken)
               # Build.Reason is predefined and auto-exposed as $BUILD_REASON;
               # reference it directly and do not map it here (env: overrides
               # of reserved variables are silently ignored by the agent).