Azd provisioning - #33
Merged
Merged
Conversation
…zure-finops-agent into azd-provisioning
Ignore compiled Bicep ARM output (keep *.parameters.json) and untrack the 3 stray artifacts (main.json, main-resources.json, modules/appservice.json). Ignore .pw-profile/ (Playwright profile w/ cookies), *.lscache, and .pw-social-preview-result.png. Add upload-social-preview.mjs maintainer utility.
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
|
|
||
| // Click "Edit" (or "Upload an image..." if no image is set yet). | ||
| const editBtn = page.getByRole('button', { name: /^edit$/i }).first(); | ||
| const uploadBtn = page.getByRole('button', { name: /upload an image/i }).first(); |
…ions gpt-5.4 is version 2026-03-05, not 2025-08-07 (that belongs to the original gpt-5) - the old pin would fail the AOAI model deployment. Also constrain location and aoaiLocation to the 29 regions where gpt-5.4 Global Standard is available (verified via az model catalog + Foundry region-availability docs) so azd up succeeds for any customer.
…ed-identity auth Switch aoai.bicep from classic kind:OpenAI to kind:AIServices + allowProjectManagement (API 2026-03-01), matching the live finops-agent-ai resource. Grant the Web App MI 'Cognitive Services OpenAI User' (5e0bd9bd) instead of 'Cognitive Services User'. Keep disableLocalAuth:true - managed identity only, no API keys. Endpoint output (properties.endpoint) unchanged; prod confirms Copilot SDK BYOK works with the cognitiveservices.azure.com host. Docs updated.
Add infra/scripts/postdown.ps1 to remove the Entra app registration that preprovision creates - only when azd created it (AZURE_ENTRA_APP_CREATED_BY_AZD marker), never a bring-your-own AZURE_ENTRA_APP_ID. preprovision sets the marker and preserves it across azd up retries. Best-effort (exit 0 + continueOnError) so it never blocks teardown. Without this, every up/down cycle orphaned a multi-tenant app and secret. README and copilot-instructions updated.
…t hooks, classic-builder Dockerfile) - Secretless: preprovision creates the Entra app with -NoSecret; postprovision federates the App Service MI to it (Workload Identity Federation). No client secret anywhere. - Hooks: read azd env via 'azd env get-values -o json | ConvertFrom-Json -AsHashtable' (ConvertFrom-StringData broke on the App Insights connection string); force redirect-URI array with @(). - Dockerfile: drop BuildKit-only RUN --mount=type=cache so az acr build classic builder works (buildx prod build still works via registry cache). - .dockerignore: **/node_modules/ (frontend/node_modules was bloating the context to 438MB).
…s CSP CSRF middleware blocked POSTs from any host not in a hardcoded production allowlist, so /api/chat returned 403 on every azd deployment (app-finops-<token>.azurewebsites.net). Now allows same-origin writes (Origin/Referer host == request host). CSP connect-src hardcoded the canadacentral App Insights endpoint, blocking frontend telemetry in other regions. Wildcarded to *.in.applicationinsights.azure.com and *.livediagnostics.monitor.azure.com.
…for GPT-5 reasoning
The session sets ReasoningEffort=xhigh on gpt-5.4 (GPT-5 series), which requires the Responses API. Provider was type=azure (Chat Completions, api-version 2024-10-21) with no /openai/v1/ path or WireApi, so reasoning requests never completed and chat hung forever. Switch to type=openai + {endpoint}/openai/v1/ + WireApi=responses per GitHub Copilot SDK BYOK docs for Azure AI Foundry. Also derive SEO/sitemap base URL from request host and gate IndexNow on PUBLIC_SITE_HOST so the template works on any deployment domain.
…ime limit Default B1 had Always On off, so the app unloaded when idle and the next request paid an ~80s container cold start (looks like the agent is unresponsive). Enable Always On (supported on all allowed SKUs) and set WEBSITES_CONTAINER_START_TIME_LIMIT=1800 so the heavy node+.NET+Python+OTel image doesn't exceed the 230s default on first start.
… was hitting 429) GlobalStandard capacity is a per-token-billed rate-limit knob (raising it is free). 30K TPM rate-limited the agent's xhigh reasoning + tool calls. Default now 100K; overridable via AZURE_OPENAI_MODEL_CAPACITY.
Template created the AIServices account + account-level gpt-5.4 deployment but no project, so nothing showed under the account in the AI Foundry portal. Add a Microsoft.CognitiveServices/accounts/projects resource (schema validated live) and surface AZURE_AI_PROJECT_NAME. Not required by the app runtime (BYOK calls the account /openai/v1/ endpoint) but completes the Foundry reference architecture.
# Conflicts: # src/Dashboard/Dockerfile # src/Dashboard/Program.cs
|
|
||
| foreach (var kv in StaticFaqs) | ||
| urls += "<url><loc>https://azure-finops-agent.com/faq/" + kv.Key + "</loc><lastmod>" + today + "</lastmod><changefreq>monthly</changefreq><priority>0.8</priority></url>"; | ||
| urls += "<url><loc>" + baseUrl + "/faq/" + kv.Key + "</loc><lastmod>" + today + "</lastmod><changefreq>monthly</changefreq><priority>0.8</priority></url>"; |
|
|
||
| foreach (var kv in FaqTools.GetAll()) | ||
| urls += "<url><loc>https://azure-finops-agent.com/faq/" + kv.Key + "</loc><lastmod>" + kv.Value.CreatedUtc + "</lastmod><changefreq>monthly</changefreq><priority>0.7</priority></url>"; | ||
| urls += "<url><loc>" + baseUrl + "/faq/" + kv.Key + "</loc><lastmod>" + kv.Value.CreatedUtc + "</lastmod><changefreq>monthly</changefreq><priority>0.7</priority></url>"; |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Type of change
Checklist
dotnet build)npm run buildinsrc/Dashboard/frontend).github/copilot-instructions.mdif behaviour or structure changedCHANGELOG.mdunder[Unreleased]Related issues
Closes #