From eb669da4a9560cd43551cb3530e24d02d82cf629 Mon Sep 17 00:00:00 2001
From: Rob Gilbreath <rob.gilbreath@pncit.com>
Date: Fri, 11 Sep 2026 14:37:28 -0800
Subject: [PATCH] ci: deploy cippkvupn-proc from the same run as cippkvupn

cippkvupn-proc is the offload (processor) node for cippkvupn, but it had no
CI/CD at all - it was hand-deployed once. CIPP only dispatches timers to an
offload node whose version EXACTLY matches the main app's, so any drift
silently drops the node and makes both apps run the processor timers.

Add a second Azure/functions-action step to the existing deploy job so the
same checkout is pushed to both apps in one run. No second checkout and no
rebuild, so the two apps cannot skew. The existing cippkvupn step is
untouched and still runs first.

Action ref is pinned to the same commit SHA already used for the main app,
per the convention from "ci: pin our deploy workflow's action refs".

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
---
 .github/workflows/master_cippkvupn.yml | 21 ++++++++++++++++++++-
 1 file changed, 20 insertions(+), 1 deletion(-)

diff --git a/.github/workflows/master_cippkvupn.yml b/.github/workflows/master_cippkvupn.yml
index edbef348198d0..08eb3e97763a1 100644
--- a/.github/workflows/master_cippkvupn.yml
+++ b/.github/workflows/master_cippkvupn.yml
@@ -2,6 +2,8 @@
 # More GitHub Actions for Azure: https://github.com/Azure/actions
 
 name: Build and deploy Powershell project to Azure Function App - cippkvupn
+# Deploys the SAME checkout to the main app and its offload (processor) app.
+# See the 'version lockstep' note on the cippkvupn-proc step below before editing.
 
 on:
   push:
@@ -27,4 +29,21 @@ jobs:
           app-name: 'cippkvupn'
           slot-name: 'Production'
           package: ${{ env.AZURE_FUNCTIONAPP_PACKAGE_PATH }}
-          publish-profile: ${{ secrets.AZUREAPPSERVICE_PUBLISHPROFILE_96E4A9290D1D4F3DA01D74E0BE6ED0E1 }}
\ No newline at end of file
+          publish-profile: ${{ secrets.AZUREAPPSERVICE_PUBLISHPROFILE_96E4A9290D1D4F3DA01D74E0BE6ED0E1 }}
+
+      # cippkvupn-proc is the offload/processor node for cippkvupn. CIPP only dispatches
+      # timers to an offload node when its version EXACTLY matches the main app's:
+      #   Modules/CIPPCore/Public/Get-CIPPTimerFunctions.ps1
+      #     $AvailableNodes = $Nodes | Where-Object { ... -and $_.Version -eq $MainFunctionVersion }
+      # On mismatch the node is silently dropped (no error) and BOTH apps fall back to
+      # running the processor timers, double-dispatching them against every tenant.
+      # So both apps must ship the same commit, in the same run. This step deploys the
+      # very same checkout as the step above - no second checkout, no rebuild.
+      - name: 'Run Azure Functions Action - offload node (cippkvupn-proc)'
+        uses: Azure/functions-action@c5060b3b8bb1ebbcb531abd00c822ecbaa8ea656 # v1.5.7
+        id: fa-proc
+        with:
+          app-name: 'cippkvupn-proc'
+          slot-name: 'Production'
+          package: ${{ env.AZURE_FUNCTIONAPP_PACKAGE_PATH }}
+          publish-profile: ${{ secrets.AZUREAPPSERVICE_PUBLISHPROFILE_CIPPKVUPN_PROC }}
\ No newline at end of file