Platform Evolution
Assessment run-2026-07-27-1 · 213 of 213 repos assessed
Repos / advent-challenger

advent-challenger

Seasonal marketing advent-calendar competition web app where users open daily doors backed by a Competitions SQL database.

40 · redlowlooseOn-premZDD: a long roadweb-uisecrets in source

Health score

40

0 to 100 across seven weighted factors; nothing is hidden. Green is 75 and above, amber 50 to 74, red below 50. How scoring works.


Runtime currency / 25
0
.NET Framework, out of mainstream support
Legacy transport / 15
15
No legacy WCF or SOAP surface
Test posture / 15
0
No tests
Security hygiene / 15
0
Credentials or keys committed to source
Dangerous coupling / 15
15
No dangerous coupling detected
Activity / 10
5
No commit in over a year
Deployment hygiene / 5
5
CI in place
Health over time
2026-07-24 (run-2026-07-24-1): 402026-07-27 (run-2026-07-27-1): 40
No change since 2026-07-24 (40 to 40).

Facts

Languagescsharp, javascript
FrameworksASP.NET MVC 4
Runtimes.NET Framework 4.0
Tests / CInone / CI in place
Last commit2025-04-16
OwnerOwner unknown (mapping to be curated)
DomainPublic web (system generated; curate in repo-owners.json to override)
Product areaShared platform
HostedOn-prem Deployed to our own machines
  • Release "\marketing\[Depricated] advent-challenger": Production: deployment-group phase (agents on our own machines)
  • Release "\marketing\[Depricated] advent-challenger": Web QA: deployment-group phase (agents on our own machines)
Releases2 release pipeline(s): \marketing\[Depricated] advent-challenger; \marketing\advent-challenger
Integrationrest
SourceOpen in Azure DevOps

Risk flags

Each flag links to its glossary definition.

Dependencies in context

No internal dependencies, dependents or shared stores recorded for this repo.
greenamberreddata store (square, dashed link)Node size follows fan-in. Click any node to open it.

Entanglement

loose No binding mechanisms apply: this system needs no untangling work.

    Depends on / used by

    Depends on (0)
    Nothing internal.
    Used by (0)
    No internal dependents.

    Data stores
    sqlserver:Competitions

    Migration playbooks

    Generated from this repo's assessment data: what is feasible, what blocks it, and the steps in order. Ratings: green means actionable now, amber means sequence other work first, red means blocked, grey means not applicable.

    ZDD adoption

    A long road

    Technically eligible one day, but the blockers are structural: hosted WCF or SOAP contracts that cannot run two versions at once, or heavy legacy coupling. Sequence the modernisation work first. Legacy web front end: session state and framework age make mixed-version fleets risky until state is externalised.

    Steps
    1. Adopt the four-stage discipline from the ZDD engineering standard: pre-deployment compatibility, deployment, feature activation behind a flag, post-release cleanup.
    2. Raise automated test coverage first: ZDD trades the end-of-sprint manual gate for continuous automated confidence, so the tests are the entry ticket.
    3. Make every change dual-version safe: backwards-compatible APIs (new major version for breaking wire changes), expand and contract for any schema change, and consumers tolerant of unknown fields.
    4. Audit serialized data: anything in Redis, queues or shared caches must deserialize cleanly across adjacent versions.
    5. Externalise any remaining session state so users can move between nodes mid-session without disruption.
    6. Wrap behaviour changes in feature flags so code deploys dark and release becomes a business decision, not a deployment event.
    7. Route deployments through the Workflow Engine's automated drain, deploy, health-check, return cycle (the path proven by the first automated production run in mid-2026).
    8. Verify with area-scoped regression rather than the whole-platform cycle, and watch error rates after rollout with automated rollback on alert.

    SQL Server exit

    Feasible after replatforming (1 owned database)

    The database is solely owned so no other system has to move, but the runtime is end-of-life; sequence the replatform first, then the engine swap.

    Steps
    1. Inventory the schema and query surface of sqlserver:Competitions: tables, stored procedures, triggers, cross-database joins and anything else engine-specific.
    2. Confirm the target: PostgreSQL (relational model; keep transactions and joins, swap the engine).
    3. Replatform to modern .NET first (see the recommended actions): current PostgreSQL and MongoDB drivers and EF Core providers target modern .NET, and doing one risky change at a time is cheaper than doing two.
    4. Data access is not through an ORM, so port the SQL by hand: translate T-SQL constructs, replace stored procedures with application code or target-native equivalents, and add integration tests around the queries that matter first.
    5. Stand up the target alongside SQL Server, backfill with an ETL pass (pgloader or an export/import job), then dual-write or replicate until parity is proven.
    6. Move reads to the target, watch correctness and latency, then cut writes over and keep SQL Server read-only until confidence is earned.
    7. Decommission the SQL Server database and remove the connection strings and firewall paths that pointed at it.

    Containerisation

    Feasible after replatforming

    Appropriate, but the .NET Framework runtime has to go first; container work rides along with the replatform rather than preceding it.

    Blockers
    • .NET Framework only runs on Windows; practical (Linux) containers need modern .NET
    Steps
    1. Replatform to modern .NET first (see the recommended actions). Containerising then becomes routine.
    2. Add a Dockerfile and make the app read all configuration from environment variables and the secrets manager, never from machine-local files.
    3. Log to stdout and expose a health check endpoint so ECS can supervise it.
    4. Adopt the shared ci.yml pipeline template with the container parameters (awsRegion, containerAfterBuild, ecsTerraformRepo), which is exactly how the estate's existing AWS services deploy.
    5. Define the service in the Terraform repo, deploy to a non-production environment, then shift traffic and disarm the deployment-group release pipeline.

    Recommended actions

    Rotate the credentials committed to advent-challenger

    Risk flags indicate credentials or keys in source (hardcoded-credentials). Rotate now and enable secret scanning in CI; this is independent of all other work.

    Impact: Closes a live security exposure at near-zero cost

    proposed

    Replatform advent-challenger to modern .NET

    Runs on .NET Framework 4.0, out of mainstream support. No pinning dependency blocks it; sequence by fan-in (providers before consumers).

    Impact: Reduces the end-of-life runtime count

    proposed

    Assessment notes

    advent-challenger

    Purpose

    A small seasonal marketing web application (TC.Competition.AdventCalender) implementing an advent-calendar competition: users open daily "doors" and door state is persisted per person via stored procedures.

    Tech stack

    Single ASP.NET MVC 4 web project targeting .NET Framework 4.0 (Razor views, jQuery-era Content assets). Data access is raw ADO.NET (SqlConnection + stored procedures). No modern SDK-style project or package management beyond packages.config.

    Deployment

    Included as a prod application with 2 releases: build pipeline advent-challenger-develop, release pipelines \marketing\advent-challenger and a [Depricated] predecessor. CI is YAML-based (azure-pipelines.yml) using shared azure-pipelines-templates Visual Studio build/test/archive steps producing a zip artifact.

    Dependencies

    No dependencies on other estate repos and no third-party services. NuGet packages are limited to ASP.NET MVC 4 / Razor 2 era Microsoft packages.

    Data stores

    SQL Server database Competitions (server Decimus in Web.config), accessed via stored procedures such as AdventCalender_SELECTByPersonID. Credentials are hard-coded in Web.config.

    Integration points

    Serves HTML plus AJAX/REST-style endpoints (AJAXController) to the browser. No message bus or outbound service calls found.

    Code health

    No test projects exist despite the CI template including a test step. README is the untouched Azure DevOps boilerplate. Last commit 2025-04-16; codebase is tiny (2 controllers, 1 model).

    Modernisation risks

    .NET Framework 4.0 and MVC 4 are long past end of life; plaintext SQL credentials in source control; zero tests. Given its tiny size and seasonal marketing nature, priority is low — retire or rewrite as a static/serverless campaign app rather than modernise in place.