feat(skills): adopt AVM-first module sourcing for Azure IaC guidance #2876

Skill Name

azure-iac-solution

Programming Language

Other

Purpose

HVE Core's Azure IaC guidance is language-oriented rather than solution-oriented. The terraform and bicep instruction files teach Copilot how to produce plausible HCL and Bicep, but they start by inventing local modules (terraform/modules/, modules/networking.bicep) and never ask whether a suitable Azure Verified Modules (AVM) pattern or resource module already exists. AVM is Microsoft's IaC module strategy and is only referenced incidentally today.

This request covers two changes:

1. Add a mandatory "Azure module sourcing" section to both language instructions establishing the AVM-first hierarchy: pattern module → AVM resource modules → native AzureRM/AzAPI/Bicep resources only for gaps → local modules only for genuine solution-specific reuse, with each direct-resource exception recorded.
2. Add a dedicated documentation-driven azure-iac-solution skill that owns AVM catalogue discovery, the module suitability test, a module decision record, the architecture-to-code workflow, and an AVM-aware review checklist.

AVM mention Spec Kit in their approach to AI-led solution development, rather than this we would adopt the underlying principles within HVE Core, leveraging IaC guidance from the AVM team.

Prerequisites

None. The skill is documentation-driven (no scripts, no executable runtime), so no SECURITY.md is required. Module versions must be resolved from the registry at execution time rather than recalled from model knowledge.

Requirements

• AVM pattern modules preferred when topology, controls, and lifecycle fit
• AVM resource modules composed for remaining capabilities
• Native resources permitted only with a recorded rationale (no AVM coverage, missing capability in the published version, essential preview API, brownfield constraints, or explicit caller requirement)
• Module versions pinned and resolved from the registry at execution time; orphaned/deprecated AVM lifecycle states inspected before adoption
• Module decision record produced before implementation, per capability
• Review checklist flags handwritten resources where AVM exists, thin wrappers, unpinned references, deprecated dependencies, and unrecorded exceptions without rejecting native resources outright
• Behavior-conformance eval stimuli backlinking the new skill and the updated terraform and bicep instructions