Fix CD pipeline: split stages + git tag-based deployment tracking

[mohamedmansour]

Problem

The hourly CD pipeline took ~30 minutes per run even when no deployment was needed. Two issues:

1. 1ES SDL overhead on every run — The pipeline had a single Package stage. Even when the Deploy job was skipped (version already published), the 1ES Official Pipeline Template still injected and ran all SDL/compliance tasks (CredScan, PoliCheck, BinSkim, Windows source analysis agent) at the stage level.

2. Registry checks unreachable from 1ES agents — The npm and crates.io HTTP checks returned HTTP 000 (connection failure) due to firewall/proxy restrictions, falsely triggering deployments against already-published versions.

Solution

1. Split into two stages

# Before: one stage — SDL overhead always runs (~30 min)
- stage: Package
  jobs:
  - job: NeedsDeployment   # ~1 min check
  - job: Deploy             # conditional, often skipped
  # 1ES SDL tasks still execute for the stage

# After: two stages — heavyweight stage skipped entirely when not needed
- stage: Check              # Lightweight version check (~1-2 min)
  jobs:
  - job: CheckVersion

- stage: Package            # Entirely skipped when needsDeployment=false
  dependsOn: Check
  condition: eq(dependencies.Check.outputs[...], 'true')
  jobs:
  - job: Deploy

When Package is skipped at the stage level, Azure Pipelines does not provision agents or run any 1ES-injected SDL tasks.

2. Replace registry HTTP checks with git tag tracking

# Before: unreliable curl to external registries (HTTP 000 on 1ES agents)
curl ... "https://registry.npmjs.org/@microsoft%2Fwebui/${VERSION}"
curl ... "https://crates.io/api/v1/crates/microsoft-webui/${VERSION}"

# After: check for deployed/* git tag (zero external network needed)
git fetch --tags --quiet
if git tag -l "deployed/v${VERSION}" | grep -q .; then
  echo "Already deployed"    # needsDeployment=false
fi

After a successful deployment, the pipeline pushes a deployed/vX.Y.Z tag:

git tag "deployed/v${VERSION}"
git push origin "deployed/v${VERSION}"

How it works

1. Check stage downloads the latest GitHub release, extracts version from .crate filename
2. Checks if deployed/v0.0.8 tag exists in the repo
3. Tag exists → needsDeployment=false → Package stage entirely skipped
4. Tag missing → needsDeployment=true → Package stage runs deployment
5. After successful deploy → pushes deployed/v0.0.8 tag

Impact

Metric	Before	After
Hourly no-op run time	~30 min	~1-2 min
External network dependency	npm + crates.io (broken)	None
False deployment triggers	Every run	None
Deploy history audit	Check pipeline logs	git tag -l "deployed/*"

Bootstrap

After merging, push the tag for the current version to prevent a re-deploy:

git tag deployed/v0.0.8
git push origin deployed/v0.0.8