Repository navigation
Qiaozha/sdk ai bots deployment - #16357
Open
Qiaoqiao Zhang (qiaozha) wants to merge 126 commits into
Open
Qiaoqiao Zhang (qiaozha) wants to merge 126 commits into
Qiaoqiao Zhang (qiaozha) wants to merge 126 commits into
Conversation
Generated by the chatbot-azd-bicep-deployment-transformer skill, leveraging
the working Bicep modules from the azd-experiments prototype.
Adds a self-contained deployment system under tools/sdk-ai-bots/deployment/:
- azure.yaml + 6-module Bicep graph (qaBotSharedResources, qaBotAgent,
qaBotFrontend, qaBotBackend, qaBotFunctionApp, qaBotLogicApp).
- Shared environment-suite (dev/preview/prod) as the single source of
truth for subscription IDs, regions, approval policy, and rollout
strategy. All pipelines consume it via load-environment-suite.yml.
- 12 reusable Azure DevOps pipeline templates (auth, bicep validate /
what-if, container build, azd provision / deploy, slot swap, smoke
test, rollback, notify).
- 15 standardized per-component pipelines (provision / CI / CD) for
frontend, backend, function-app, agent, knowledge-sync.
- 3 orchestrator pipelines (deploy-all-{dev,preview,prod}) with approval
gates and a 10-minute stabilization watch on prod.
- TypeScript hook pipeline (preprovision / postprovision / per-service
predeploy / postdeploy) that drives the infra-layer apply order and
enforces prod-only-from-pipeline.
- Runbooks (deploy, rollback), environment contract, dependency graph,
operational-readiness checklist, manual-setup guide, and the full
transformation plan (DEPLOYMENT_TRANSFORMATION.md).
Enforces build-once / promote-many: CI builds and pushes container
images to ACR; CD validates the tag exists and re-points the
App Service / Function App via slot swap. No rebuild in CD.
Existing pipelines under tools/sdk-ai-bots/azure-sdk-qa-bot-*/ are not
removed by this PR; phase-2 cutover is documented in docs/manual-setup.md.
- environment-suite.yaml: set dev subscription/subscriptionId to Azure SDK Developer Playground - move azure.yaml to tools/sdk-ai-bots/ so azd service project paths don't escape via .. - add deployment hooks/lib (deploy-layer, ensure-entra-app, layers) and update preprovision - add function-app setup-docker-image script + tsconfig; refresh package.json/lock - update main.bicepparam and .gitignore - add .github/skills/qa-bot-deployment-skill/SKILL.md
…uite - main.bicepparam: read resourceGroupName + 3 image repositories from env vars (AZURE_RESOURCE_GROUP, FUNCTION_IMAGE_REPOSITORY, RAG_BASED_BACKEND_IMAGE_REPOSITORY, AGENT_BASED_IMAGE_REPOSITORY) instead of hard-coding them, so azd provision uses the same source of truth as pipelines - sync-env-suite.ps1: also update <env>.parameters.json in place (preserving teamsGroupId/teamsChannelIds/serverAudience) and azd env set the three image repo vars - environment-suite.yaml: correct dev resourceGroupPrefix to azure-sdk-qa-bot-dev - dev.parameters.json: re-synced from env-suite
…trators - component-pipelines/*.provision.yml: expose deployLayer as a top-level parameter with per-component default (agent-platform, backend, frontend, function-app, shared-resources) and pass through to azd-provision.yml - hooks/lib/layers.ts: add frontend and function-app to INFRA_LAYERS; add params() callback returning a Record<string,string> per layer sourced from main.bicep outputs via process.env; new req() helper throws with a clear message when a required output is missing - hooks/lib/deploy-layer.ts: pass layer.params() through as --parameters key='value' with single-quote escaping - infra/main.bicep: re-export cross-module outputs (identity IDs, storage endpoint, image URIs) and input params (SERVER_AUDIENCE, TEAMS_*) as top-level outputs so azd persists them into .azure/<env>/.env - pipelines/orchestrators: split each deploy-all-*.yml into provision-all-*.yml (infra only) and deploy-all-*.yml (four component deploys in order); fix broken preview extends dev; prod provision-all stays preflight-only per original design
- infra/main.bicep + main.bicepparam: add envName param; propagate to every module block - all 6 modules (qaBotSharedResources, qaBotAgent, qaBotBackend, qaBotFrontend, qaBotFunctionApp, qaBotLogicApp) + qaBotFrontend/azureSdkQaBotModule: accept envName; every top-level resource name now ends in -${envName} (or ${envName} dashless for storage accounts and container registries per Azure naming rules) - child resources (parent:) untouched; guid()-based role assignment names untouched (recompute from parent id) - frontend userAssignedIdentity.bicep: replaced hardcoded ARM resource IDs (userAssignedIdentity, hidden-link tag) with symbolic .id references; azureSdkQaBotModule cross-RG scope now uses azure-sdk-qa-bot-${envName} - SERVER_AUDIENCE + TEAMS_* re-export outputs from earlier commit unaffected - bicep build validated - known drift: env-suite.yaml keyVaultName/appConfigName/containerRegistryName still hold their prior 'azsdkqabot-*' values while Bicep now emits 'qzqabot-*-${envName}' - reconcile separately if you want env-suite to reflect actual deployed names
Add ADE environment definition (environment.yaml) + RG-scoped entry template (infra/ade/main.bicep) reusing the existing layer modules with auto-generated names. Add PR create/delete template (pr-environment.yml), PR-triggered orchestrator (pr-ephemeral.yml), and scheduled pool reaper (pr-reaper.yml). Document one-time Dev Center setup in manual-setup.md (section 16).
Introduces deployment/config/<env>/ as the source of truth for the Teams bot's per-environment configuration (channel registrations, tenant → channel mapping). Files are uploaded to the shared storage account's bot-configs container by the new hooks/lib/upload-bot-configs.ts helper, invoked from hooks/postprovision.ts after the infra-layer pipeline completes. Env-specific because each embeds the backend/agent web-app endpoint URL and the Teams channel IDs the bot is registered against — both differ across dev/preview/prod. Only dev/ is populated in this commit; preview/ and prod/ directories can be added later.
Merge the standalone *.provision.yml files into their corresponding
*.cd.yml pipelines for all five components (agent, backend, frontend,
function-app, knowledge-sync).
Each CD pipeline now has two stages:
1. Provision stage — two jobs:
- InfraDiff: detects changed infra files via `git diff HEAD~1`
and sets output variable INFRA_CHANGED.
- Apply (deployment job): runs bicep-validate, bicep-what-if, and
azd-provision only when INFRA_CHANGED=true or runProvision=true.
2. Deploy stage — existing CD logic, runs after Provision succeeds
(or is fully skipped due to no infra diff).
New parameters added to each CD:
- runProvision (boolean, default: false) — forces provision regardless
of detected diff.
- deployLayer (string) — scopes the azd provision graph, carried over
from the old provision pipelines.
Deleted: agent/agent.provision.yml, backend/backend.provision.yml,
frontend/frontend.provision.yml, function-app/function-app.provision.yml,
knowledge-sync/knowledge-sync.provision.yml
- fix agent.yaml: add template.kind/name/protocols fields; wire into azure.yaml service definition - fix sharedResources.bicep: add location param (was hardcoded westus2 on all resources); add cosmosDbLocation param for AZ-capacity workaround (dev → eastus) - fix main.bicep: wire location/cosmosDbLocation/developerGroupObjectId/developerPrincipalType into sharedResources and agent modules - fix main.bicepparam: add aiLocation, AZURE_AI_DEPLOYMENTS_LOCATION, developerPrincipalId/Type, cosmosDbLocation env var bindings - fix component.bicep: promote developerGroupObjectId to param with if(!empty) guard and developerPrincipalType param - fix ensure-entra-app.ts: add serviceManagementReference support for tenant policies - fix preprovision.ts: fix SUITE_PATH (was missing 'deployment/' prefix); add ensureDeveloperPrincipal() to auto-detect deployer identity; add SERVICE_MANAGEMENT_REFERENCE support - fix sync-env-suite.ps1: handle empty azd env list; add AZURE_AI_DEPLOYMENTS_LOCATION sync - fix azure.yaml: add kind/name/protocols to agent service definition for azure.ai.agents extension - fix environment-suite.yaml: update dev subscription/tenant/region to centralus - fix dev.parameters.json: set location=centralus, cosmosDbLocation=eastus - fix prod.parameters.json: add developerGroupObjectId and developerPrincipalType=Group
…re-sdk-tools into qiaozha/sdk-ai-bots-deployment
Provision fixes:
- ensure-entra-app: look up existing qabot app registrations owned by the
signed-in user via 'az ad app list --show-mine' before attempting to
create a new one (unblocks tenants that require SERVICE_MANAGEMENT_REFERENCE).
- Cognitive Services: chain gpt-4.1 -> gpt-5.4 -> gpt-5.1 -> gpt-5-mini ->
text-embedding-ada-002 -> storage connection with 'dependsOn' so ARM
serializes updates against the parent account (avoids RequestConflict).
- Foundry project storage connection: rename to '<storage>-project' to
avoid collision with the account-level connection of the same name.
- Cognitive Services agent.yaml: flatten to top-level 'kind: hosted' shape
(azd extension no longer accepts the old 'template:' wrapper).
- azure.yaml agent service: drop deprecated 'config:' block, move
startupCommand to service level.
- Logic App connections: use parameterValueSet 'managedIdentityAuth' for
azureblob and documentdb so workflow MSI authentication validates.
- Logic App metric alert: parameterize actionGroupName so it matches the
actual '${_suffix}'-derived name from qaBotSharedResources.
- Bicep tags: add 'azd-service-name' to Microsoft.Web/sites for function-app
and frontend so 'azd deploy <service>' can locate the target.
Logic App bootstrap workaround:
- The workflow's function.id action references convertActivity inside the
Function App container. ARM validates that reference against the host
runtime at deploy time, which returns 503 until the container image is
live. On the first 'azd provision' the container hasn't been pushed yet,
so full workflow creation always fails.
- Fix: add includeWorkflowDefinition bool to qaBotLogicApp module. main.bicep
passes false so provision creates the workflow shell (identity, connections,
integration account, alert) with an empty definition. The real definition
is applied afterwards via ARM GET-then-PUT (Microsoft.Logic/workflows
rejects PATCH on any properties field).
- Shared helper hooks/lib/patch-workflow.ts:
* Enforces the function-app-first dependency by polling
/admin/host/status until 200 (5-min timeout by default) before the PUT,
with an actionable error hint if the container isn't deployed yet.
* Substitutes functionAppResourceId into the workflow JSON template.
- Global postdeploy hook (hooks/postdeploy.ts) invokes patchWorkflow so
the Logic App is updated after any 'azd deploy'. function-postdeploy is
reduced back to a plain health check.
- Standalone CLI: scripts/deploy-logic-app.ts + 'npm run deploy:logic-app --
-e <env>' for iterating on the workflow without redeploying services.
Postprovision pipeline:
- Fix BICEP_BASE path from 'infra/modules' to 'deployment/infra/modules'
(azd runs the hook with cwd at the azure.yaml root).
- Remove the logic-app layer (Logic App is no longer applied through this
pipeline; see above).
- Join az CLI arg strings on single spaces instead of backslash-newlines
so the command parses under Windows cmd.exe (used by execSync).
- Short-circuit the full-graph run when DEPLOY_LAYER is unset — main.bicep
already applied every module in the same azd provision call, so the
duplicate pipeline is both redundant and would hit parameter drift on
location defaults.
New / removed files:
- Add hooks/lib/patch-workflow.ts (shared GET-then-PUT helper).
- Add scripts/deploy-logic-app.ts (standalone CLI wrapper).
- Add 'deploy:logic-app' npm script.
- azure.yaml: add backend service (docker/remoteBuild); wire agent/frontend/function-app predeploy hooks to az acr build (no local Docker) - backend: self-contained Docker build context; add azd-service-name tag, WEBSITES_PORT=8088, AZURE_APPCONFIG_ENDPOINT, acrUserManagedIdentityID - sharedResources: grant AcrPull to shared identity (Contributor lacks data-plane pull) - component.bicep: keep only Foundry Project Manager + OpenAI User (drop redundant AI Developer / Cog Contributor); output AZURE_AI_PROJECT_ID + FOUNDRY_PROJECT_ENDPOINT - functionApp: add acrUserManagedIdentityID for MI-based ACR pull - logicApp: fix parameterValueSet pragma; patch-workflow accepts 401/403 as host-ready - postprovision: resolve azd deployment name as <env>-<timestamp> - dev params/env-suite: aiLocation=eastus2 (Foundry Hosted Agents supported region) - remove unused setup-docker-image scripts
…output casing
- agent: grant the Foundry project MI AcrPull on the shared ACR and wire the pre-built image (image: ${AGENT_DEPLOYED_IMAGE} + agent-predeploy prepackage hook) so 'azd deploy agent' uses the pushed image instead of a non-existent default repo
- backend: re-pin acrUserManagedIdentityID in the postdeploy hook because 'azd deploy' clears it, which otherwise breaks the MI-based ACR image pull (503)
- postprovision: upper-case ARM output keys before 'azd env set' to avoid case-mismatched duplicate env vars
…ackend health self-heal - ensure-entra-app: add ensureServerAppAuthorization (SP, identifier URI, delegated scope, app role, pre-auth clients, MI app-role assignment) - seed-app-config: new lib to seed fixed + auto-injected App Configuration values; grants deployer App Configuration Data Owner with RBAC-propagation retry - seed-key-vault: new lib to seed AI-SEARCH-APIKEY and AOAI-CHAT-COMPLETIONS-API-KEY from provisioned resources; grants deployer Key Vault Secrets Officer with retry - postprovision: wire in Key Vault secret + App Configuration seeding - agent-postdeploy: ensure server app authorization before ping - backend-postdeploy: self-heal Key Vault tenant drift, seed secrets, and send bearer token on /ping health check - sharedResources.bicep: set Key Vault tenantId to subscription().tenantId (was hardcoded to wrong tenant, causing backend crash) - docs: mark App Configuration seeding as automated
Qiaoqiao Zhang (qiaozha)
requested review from
a team,
Jiaqi Zhang (JiaqiZhang-Dev),
Crystal YU (chunyu3) and
Renhe Li (lirenhe)
as code owners
July 15, 2026 06:12
|
Azure Pipelines: Successfully started running 2 pipeline(s). 61 pipeline(s) were filtered out due to trigger conditions. There may be pipelines that require an authorized user to comment /azp run to run. |
📊 GEPA Skill Quality Scores
13/18 skills at quality ≥ 0.80 How to improve# Score a specific skill
python .github/skills/sensei/scripts/gepa/auto_evaluator.py score --skill <name> --skills-dir .github/skills --tests-dir tests
# Optimize a skill with GEPA
python .github/skills/sensei/scripts/gepa/auto_evaluator.py optimize --skill <name> --skills-dir .github/skills --tests-dir tests |
Contributor
There was a problem hiding this comment.
Pull request overview
Adds a new tools/sdk-ai-bots/deployment/ “single source of truth” deployment scaffold for sdk-ai-bots, including azd hooks, infra (Bicep), and standardized Azure DevOps CI/CD pipeline templates/orchestrators. It also updates existing bot components to align with the new build-once / deploy-many workflow.
Changes:
- Introduces deployment infra + environment contract (Bicep +
environment-suite.yaml) and operational docs/runbooks. - Adds reusable ADO pipeline templates + per-component CI/CD pipelines and orchestrators (dev/preview/prod + PR ephemeral env support).
- Adds azd hooks/scripts for provisioning/deploy guardrails, seeding, smoke/drift checks, and removes a legacy frontend Docker build script.
Reviewed changes
Copilot reviewed 103 out of 106 changed files in this pull request and generated 13 comments.
Show a summary per file
| File | Description |
|---|---|
| tools/sdk-ai-bots/deployment/tsconfig.json | TS config for deployment hooks/scripts. |
| tools/sdk-ai-bots/deployment/scripts/validate-env-suite.ps1 | Validates env-suite contract (keys/placeholders). |
| tools/sdk-ai-bots/deployment/scripts/smoke-test.ps1 | Manual smoke probe helper for component endpoints. |
| tools/sdk-ai-bots/deployment/scripts/rollback.ps1 | Manual rollback helper (LastKnownGoodTag). |
| tools/sdk-ai-bots/deployment/scripts/detect-drift.ps1 | Manual what-if drift detector helper. |
| tools/sdk-ai-bots/deployment/scripts/deploy-logic-app.ts | Standalone Logic App workflow patch script. |
| tools/sdk-ai-bots/deployment/scripts/check-quotas.ts | Standalone quota check CLI (tsx). |
| tools/sdk-ai-bots/deployment/README.md | Deployment root overview + quickstart. |
| tools/sdk-ai-bots/deployment/pipelines/templates/webapp-deploy.yml | Template: deploy container to App Service (slot-aware). |
| tools/sdk-ai-bots/deployment/pipelines/templates/swap-slot.yml | Template: App Service slot swap. |
| tools/sdk-ai-bots/deployment/pipelines/templates/smoke-test.yml | Template: HTTP smoke probe (optional EasyAuth). |
| tools/sdk-ai-bots/deployment/pipelines/templates/rollback.yml | Template: rollback via App Config LastKnownGoodTag. |
| tools/sdk-ai-bots/deployment/pipelines/templates/provision-stage.yml | Template: provision stage wrapper (validate/what-if/provision). |
| tools/sdk-ai-bots/deployment/pipelines/templates/pr-environment.yml | Template: create/delete ADE PR environment. |
| tools/sdk-ai-bots/deployment/pipelines/templates/notify.yml | Template: Teams webhook notification. |
| tools/sdk-ai-bots/deployment/pipelines/templates/load-environment-suite.yml | Template: export env-suite values into pipeline variables. |
| tools/sdk-ai-bots/deployment/pipelines/templates/deploy-stage.yml | Template: orchestrate multi-component deploy order. |
| tools/sdk-ai-bots/deployment/pipelines/templates/container-build.yml | Template: build & push images (tag strategies). |
| tools/sdk-ai-bots/deployment/pipelines/templates/bicep-what-if.yml | Template: subscription what-if with approval gating. |
| tools/sdk-ai-bots/deployment/pipelines/templates/bicep-validate.yml | Template: bicep build + lint. |
| tools/sdk-ai-bots/deployment/pipelines/templates/azd-provision.yml | Template: azd provision (optionally layered). |
| tools/sdk-ai-bots/deployment/pipelines/templates/azd-deploy.yml | Template: azd deploy consuming prebuilt images. |
| tools/sdk-ai-bots/deployment/pipelines/templates/azd-auth.yml | Template: federated az/azd auth + azd install. |
| tools/sdk-ai-bots/deployment/pipelines/README.md | Pipeline structure/composition guide. |
| tools/sdk-ai-bots/deployment/pipelines/orchestrators/provision-all-prod.yml | Orchestrator: prod preflight provision. |
| tools/sdk-ai-bots/deployment/pipelines/orchestrators/provision-all-preview.yml | Orchestrator: preview provision. |
| tools/sdk-ai-bots/deployment/pipelines/orchestrators/provision-all-dev.yml | Orchestrator: dev provision. |
| tools/sdk-ai-bots/deployment/pipelines/orchestrators/pr-reaper.yml | Orchestrator: scheduled ADE PR env cleanup. |
| tools/sdk-ai-bots/deployment/pipelines/orchestrators/pr-ephemeral.yml | Orchestrator: PR ADE provision + deploy + smoke. |
| tools/sdk-ai-bots/deployment/pipelines/orchestrators/deploy-all-prod.yml | Orchestrator: prod deploy chain + stabilization. |
| tools/sdk-ai-bots/deployment/pipelines/orchestrators/deploy-all-preview.yml | Orchestrator: preview deploy chain. |
| tools/sdk-ai-bots/deployment/pipelines/orchestrators/deploy-all-dev.yml | Orchestrator: dev deploy chain. |
| tools/sdk-ai-bots/deployment/package.json | Dev deps + scripts for hooks/scripts (tsx/typescript). |
| tools/sdk-ai-bots/deployment/infra/README.md | Infra layout + apply/what-if guidance. |
| tools/sdk-ai-bots/deployment/infra/modules/qaBotFunctionApp/serverfarm.bicep | Function App plan/site + settings (container). |
| tools/sdk-ai-bots/deployment/infra/modules/qaBotFrontend/azureSdkQaBotModule.bicep | Frontend identity storage role assignments. |
| tools/sdk-ai-bots/deployment/infra/main.bicepparam | azd parameterization for dev/local provisioning. |
| tools/sdk-ai-bots/deployment/infra/environments/prod.parameters.json | Prod ARM parameter values. |
| tools/sdk-ai-bots/deployment/infra/environments/preview.parameters.json | Preview ARM parameter values. |
| tools/sdk-ai-bots/deployment/infra/environments/environment-suite.yaml | Env + component contract source-of-truth. |
| tools/sdk-ai-bots/deployment/infra/environments/dev.parameters.json | Dev ARM parameter values. |
| tools/sdk-ai-bots/deployment/infra/environment.yaml | ADE environment definition manifest. |
| tools/sdk-ai-bots/deployment/hooks/predown.ts | Guardrail: azd down allowed only for dev. |
| tools/sdk-ai-bots/deployment/hooks/predeploy.ts | Guardrail: block non-pipeline prod deploys; enforce build-once. |
| tools/sdk-ai-bots/deployment/hooks/postprovision.ts | Persist outputs + run infra layering + seed/upload steps. |
| tools/sdk-ai-bots/deployment/hooks/postdown.ts | Post-down cleanup stub. |
| tools/sdk-ai-bots/deployment/hooks/postdeploy.ts | Global postdeploy: Logic App patch + LKG stub. |
| tools/sdk-ai-bots/deployment/hooks/lib/upload-bot-configs.ts | Upload env-specific bot-config blobs to storage. |
| tools/sdk-ai-bots/deployment/hooks/lib/seed-key-vault.ts | Seed backend-required secrets into Key Vault (RBAC retry). |
| tools/sdk-ai-bots/deployment/hooks/lib/layers.ts | Defines infra layer pipeline (DEPLOY_LAYER). |
| tools/sdk-ai-bots/deployment/hooks/lib/deploy-layer.ts | Runs a single layer via az deployment group create. |
| tools/sdk-ai-bots/deployment/hooks/function-predeploy.ts | Function image build/push via ACR (skippable in CI). |
| tools/sdk-ai-bots/deployment/hooks/function-postdeploy.ts | Function postdeploy state check. |
| tools/sdk-ai-bots/deployment/hooks/frontend-predeploy.ts | Frontend build + ACR build/push (skippable in CI). |
| tools/sdk-ai-bots/deployment/hooks/frontend-postdeploy.ts | Frontend health probe postdeploy. |
| tools/sdk-ai-bots/deployment/hooks/agent-predeploy.ts | Agent image handling + azd image override + docker shim. |
| tools/sdk-ai-bots/deployment/hooks/agent-postdeploy.ts | Agent authorization + /ping sanity check. |
| tools/sdk-ai-bots/deployment/docs/runbook-rollback.md | Rollback operational runbook. |
| tools/sdk-ai-bots/deployment/docs/runbook-deploy.md | Deploy/promotion runbook. |
| tools/sdk-ai-bots/deployment/docs/operational-readiness-checklist.md | Prod readiness checklist. |
| tools/sdk-ai-bots/deployment/docs/environment-contract.md | Env-suite schema/validation/sync contract. |
| tools/sdk-ai-bots/deployment/docs/deployment-architecture.md | High-level deployment architecture doc. |
| tools/sdk-ai-bots/deployment/docs/component-dependency-graph.md | Dependency graph + deploy ordering doc. |
| tools/sdk-ai-bots/deployment/config/README.md | Bot-configs tree guidance. |
| tools/sdk-ai-bots/deployment/config/dev/tenant.yaml | Dev tenant/channel metadata. |
| tools/sdk-ai-bots/deployment/config/dev/channel.yaml | Dev channel routing config. |
| tools/sdk-ai-bots/deployment/component-pipelines/knowledge-sync/knowledge-sync.ci.yml | Knowledge-sync CI pipeline. |
| tools/sdk-ai-bots/deployment/component-pipelines/knowledge-sync/knowledge-sync.cd.yml | Knowledge-sync scheduled CD pipeline. |
| tools/sdk-ai-bots/deployment/component-pipelines/function-app/function-app.ci.yml | Function-app CI pipeline. |
| tools/sdk-ai-bots/deployment/component-pipelines/function-app/function-app.cd.yml | Function-app CD pipeline. |
| tools/sdk-ai-bots/deployment/component-pipelines/frontend/frontend.ci.yml | Frontend CI pipeline (image + Teams package). |
| tools/sdk-ai-bots/deployment/component-pipelines/frontend/frontend.cd.yml | Frontend CD pipeline (slot deploy + swap + rollback). |
| tools/sdk-ai-bots/deployment/component-pipelines/backend/backend.ci.yml | Backend CI pipeline (Go build/test/lint + image). |
| tools/sdk-ai-bots/deployment/component-pipelines/backend/backend.cd.yml | Backend CD pipeline (slot deploy + swap + rollback). |
| tools/sdk-ai-bots/deployment/component-pipelines/agent/agent.ci.yml | Agent CI pipeline (python lint/test + image). |
| tools/sdk-ai-bots/deployment/component-pipelines/agent/agent.cd.yml | Agent CD pipeline (server slot + hosted agent deploy). |
| tools/sdk-ai-bots/deployment/.gitignore | Ignores node_modules/.azure; re-includes hooks/lib. |
| tools/sdk-ai-bots/azure.yaml | azd manifest updated to use deployment hooks and services. |
| tools/sdk-ai-bots/azure-sdk-qa-bot/scripts/setup-docker-image.ps1 | Removes legacy local docker build/push script. |
| tools/sdk-ai-bots/azure-sdk-qa-bot/README.md | Updates docs to use azd deploy frontend instead of legacy script. |
| tools/sdk-ai-bots/azure-sdk-qa-bot/package-lock.json | Lockfile update (platform metadata changes). |
| tools/sdk-ai-bots/azure-sdk-qa-bot-function/scripts/tsconfig.json | Adds scripts tsconfig for function tooling. |
| tools/sdk-ai-bots/azure-sdk-qa-bot-function/package.json | Adds tsx to function dev deps. |
| tools/sdk-ai-bots/azure-sdk-qa-bot-backend/pipeline/cd.yml | Adjusts docker build context path. |
| tools/sdk-ai-bots/azure-sdk-qa-bot-backend/Dockerfile | Aligns COPY with new build context assumption. |
| tools/sdk-ai-bots/azure-sdk-qa-bot-agent/agents/chat_agent/agent.yaml | Adds hosted agent metadata (kind/protocols/description). |
Files not reviewed (3)
- tools/sdk-ai-bots/azure-sdk-qa-bot-function/package-lock.json: Generated file
- tools/sdk-ai-bots/azure-sdk-qa-bot/package-lock.json: Generated file
- tools/sdk-ai-bots/deployment/package-lock.json: Generated file
Mock the newly introduced async stale-job recovery in the PR-specific ordering test and verify its invocation. Validated with Pyright and all 425 agent-server CI-selected tests. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Keep upstream Function App removal, discard its orphaned deployment files, and retain production-only frontend dependencies in a separate runtime stage. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Seed routing configuration required by daily feedback startup, update the inactivity-closure test mock, preserve container dependency boundaries, and correct WebJob and signing-key setup guidance. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Read overrides as raw yq scalars instead of CSV-quoted TSV and escape Azure Pipelines logging data. Add executable loader regressions for JSON, multiline values, literal escape sequences, and override conflicts. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Remove implementation-fix narratives and historical reports, clarify deployment scope and operational prerequisites, and align documentation links with repository guidance. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Compare desired allocations with existing resources, use the configured AI region and model SKU, and validate only additional capacity. Fail explicitly when required ARM state or quota data is unavailable. Keep the hook and standalone checker consistent and cover unchanged resources, growth, new allocations, and error handling. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Stop provisioning the unused application secret vault, seeding its Search key, exporting its settings, and granting its roles. Remove the unused secret client and purge stub while retaining the external GitHub signing vault and its key permissions. Update deployment contracts, regression tests, and process documentation. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Use the configured or workflow-referenced connection instead of resource-group-wide discovery. Validate workflow bindings, resource scope, and Teams managed API IDs before consent checks. Preserve the selected connection across approval and verification, with executable regression coverage. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Reuse effective agent-write permissions before creating assignments. Add missing project-scoped Foundry User grants only as needed, verify propagation, and fail explicitly when bootstrap privileges are missing. Wire native and hosted deployment paths independently of dev RBAC management and remove the conflicting declarative deployment Foundry role. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Enable dev authorization and data-plane reconciliation, restore the declared deployment Foundry role, and remove the extra REST permission-check layer and deployment hooks. Keep the established runtime role helper and document the required provisioning authority. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Remove the authorization-management flag and reconcile existing or missing resource grants through layer hooks. Adopt preview test-group names, use qa-bot-dev for dev, retain other configured connection selections, and permit its backend readiness client. Add the administrator bootstrap script, process documentation, and hermetic regression coverage. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Qiaoqiao Zhang (qiaozha)
requested review from
Jialin Huang (JialinHuang803) and
Chenjie Shi (tadelesh)
as code owners
October 31, 2026 08:07
Remove the subscription-scoped resource-group layer and bootstrap deployment grant. Verify existing groups before provisioning, retain pipeline-owned backend authentication, and update deployment documentation and regression tests. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Switch dev deployments to azuresdkqabot-dev while retaining other connection mappings. Clarify the optional qa-bot-dev bootstrap and remove the unreferenced slot-swap template with regression coverage. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> # Conflicts: # tools/sdk-ai-bots/azure-sdk-qa-bot-agent/pipelines/agent-cd.yml
Align dev branch routing, hosted-agent metadata and runtime identity grants with merged chatbot changes. Sync Logic App filters and channel routes, consolidate the dev MCP listener, and keep preview on production Teams channels with preview-owned resources. Update deployment documentation and regression coverage. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Remove the duplicate Logic App updater, deselected service-connection bootstrap, stale caller, and single-layer provisioning template. Drop unused slot options and compatibility helpers, simplify hosted-agent state loading, and validate health probes without shell eval. Update operator documentation and regression coverage. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Preserve both feedback orchestration and production-failure tests, adopt the Teams 1.25 manifest with package version 1.0.5, and synchronize connector image downloads into the deployment-owned SDK and MCP workflows. Document coordinated rollout requirements and add workflow parity and executable image-preparation coverage. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Member
Author
Two-week chatbot deployment audit (2026-10-25 through 2026-11-08)Merged latest Cross-checked all 41 repository PRs merged in the window against chatbot-path commit history and verified GitHub merge timestamps. Audited 15 chatbot-related PRs: 14 affect deployed code, configuration, or infrastructure; the code-owner update alone needs no rollout.
Deployment changes added
Validation
This is source/deployment-contract verification, not a live Azure rollout. Teams connector authorization, external portal/ADO/GitHub access, and end-to-end cloud smoke checks remain operational prerequisites. Unrelated local changes were not included. |
Leave WebJob packaging, SSH configuration, and deployment in the existing package-owned backend CD workflow. Remove the duplicate deployment stage and helper, stop granting shared-runtime Search write/indexer access, and retain query-only access with existing Contributor grants accepted. Keep Search schema and indexer provisioning because the knowledge-sync package consumes rather than creates those resources. Update ownership documentation and deployment contracts. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Member
Author
Knowledge-sync ownership cleanupVerified the existing responsibilities before removing duplication:
Pushed
Retained Validation: 163 deployment tests pass, TypeScript typecheck and environment-suite validation pass, and all YAML/template references and new relative documentation links are valid. Only files under This cleanup does not remove the remaining Search system-identity bootstrap grant or resolve its missing |
Use the shared user-assigned identity already attached to Search for new datasources and preserve explicit identity settings when existing datasources are updated. Reuse its Blob access instead of creating an unused system-identity Blob Reader grant, and retain only Cognitive Services OpenAI User for Search model calls. Add identity, idempotence, malformed-input, and least-privilege tests and document the adoption behavior. Read-only dev audits found zero creations/deletions across five ARM layers and ten Search objects. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Member
Author
Reuse existing Search identity and audit resource creationPushed Fix
Read-only dev resource auditReviewed the live resource inventory, deployed models, existing Foundry connections, all five Bicep layers/parameter mappings, and detailed Azure what-if results. Property values/credentials were excluded from retained audit output.
All five managed model deployments already exist. The shared ACR is adopted as an existing resource, and backend telemetry references the existing external workspace. Other legacy/unrelated resources and extra model deployments remain untouched. No additional duplicate ARM resource creation was identified. A separate live Search reconciliation dry-run found 10 existing data-plane objects, 0 creates, 3 unchanged, 7 planned updates. Existing datasource identities are preserved. These schema/configuration updates and the ARM modifications still require normal rollout review; zero creation does not mean zero change. Validation
No Azure provision/deploy, resource deletion, or RBAC grant was performed. This fixes the unnecessary Search grant; authority to create genuinely missing grants for newly deployed hosted-agent identities remains a separate bootstrap prerequisite. |
Raise the azd minimum to 1.37.0, pin azure.ai.agents to its GA release, verify its connections/toolboxes dependencies and exact installed version, and update deployment setup documentation. Add hermetic installer tests covering the GA pin, missing dependencies, stale versions, and download failure handling. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Member
Author
Upgrade azure.ai.agents to GAPushed
Validation: 176 deployment tests pass, typecheck and environment validation pass, and the installer passes Bash syntax validation. Verified the official GA release, Linux artifact SHA-256, required azd version, service-target provider name, and dependency constraints. Reviewed the GA registry-provisioning breaking change; existing layered Bicep, source-build settings, registry endpoint and Foundry project ID remain unchanged rather than switching to prebuilt-image or external-registry-init modes. Installation validation remains blocked: the standard install in an isolated azd 1.37.3 profile reproduced the dependency-download HTTP 504. An alternative GitHub artifact download also encountered a TLS timeout. This version upgrade does not claim to fix the transport problem, and a complete GA installation/deployment was not verified. Global local azd/extensions and Azure resources/permissions were not changed; unrelated worktree edits were preserved. |
Install azd 1.37.3 into job-local tooling and propagate its PATH plus an isolated azd profile to later tasks. Pin all required extensions to 1.0.0 in azure.yaml, install dependencies before agents, and reject every installed-version mismatch. Update deployment docs and bootstrap tests for cached, outdated, missing, and failed installations. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Member
Author
Enforce exact pipeline tooling versionsPushed
Pipeline bootstrap installs/verifies the CLI in Extensions are installed at their exact manifest versions in dependency-first order, with agents last. Every installed version is checked, so a cached newer/older dependency cannot silently override the pins. Validation: 186 deployment tests pass, typecheck, environment-suite validation, and Bash syntax checks pass. The real bootstrap successfully installed azd 1.37.3 into a temporary tooling directory and verified all five existing local GA extensions at 1.0.0. Tests cover old/newer/missing CLI versions, cached reuse, PATH/profile propagation, missing pins, wrong installed versions, and download failures. No Azure deployment or RBAC changes were performed. A pipeline run has not been queued by this change. |
This branch has not been deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
This PR replaces the fragmented SDK AI bot setup with one source-controlled deployment system based on
azd, layered Bicep, reusable Azure DevOps templates, and workload identity federation.It covers the complete chatbot stack:
It also aligns runtime configuration and deployment hooks with SDK AI bot changes merged from August 7 through September 7, 2026.
Deployment process
flowchart LR CI[Component CI: build and test] --> ENV[Load environment suite] ENV --> AUTH[Authenticate with WIF] AUTH --> PREVIEW[Validate and run azd preview] PREVIEW --> APPROVE[Manual approval] APPROVE --> PROVISION[Apply seven Bicep layers] PROVISION --> SERVER[Deploy agent server] SERVER --> FUNCTION[Deploy Function App] FUNCTION --> AGENT[Deploy chat agent] AGENT --> EVOLUTION[Deploy evolution agent in prod] EVOLUTION --> FRONTEND[Deploy Teams frontend] FRONTEND --> RECONCILE[Reconcile runtime configuration and data-plane state]dev,preview, orprodenvironment is loaded fromdeployment/infra/environments/environment-suite.yaml.azd provision --preview.qa-bot-deploy.ymldefinition supportscomponent=all|shared-resources|agent|frontend|agent-server|function-app|logic-app; it applies the complete graph or the selected layer and dependencies.component=all, deployment runs agent server, Function App, chat agent, the production-only evolution agent, and frontend in dependency order. Application-scoped runs deploy only the selected service;shared-resourcesandlogic-appare provision-only. Production full-stack deployment includes an agent-server stabilization window.Key components
tools/sdk-ai-bots/azure.yamldeployment/infra/environments/environment-suite.yamldeployment/infra/layers/*deployment/hooks/*azdoperations.deployment/pipelines/templates/*deployment/pipelines/orchestrators/qa-bot-deploy.ymldeployment/config/<env>/*Infrastructure order
The
azddependency graph contains these layers:resource-groupshared-resourcesagentfrontendagent-serverfunction-applogic-appThe consolidated deployment pipeline uses the same graph and refreshes required dependencies before previewing and applying a targeted component layer.
Identity and configuration
WEB_FETCH_ALLOWED_DOMAINS.Scope audit
All remaining non-
deployment/changes support a concrete deployment boundary: remote image construction, UAMI bot authentication, WIF credential selection, hosted-agent identity/configuration, Search/wiki ingestion, or feedback/evolution integration.The unrelated repository-level
qa-bot-deployment-skillwas removed after the audit. The online/offline evaluation framework is unchanged and remains out of scope.Deployment documentation is now ordered as architecture -> environment contract -> first-time setup -> readiness -> deploy -> pipeline reference -> rollback. Historical transformation plans, presentation decks, a duplicate dependency graph, a live dev snapshot, and the dated PR-impact audit were removed; durable setup and dependency details were consolidated into the retained guides.
Provisioning and deployment now use one
qa-bot-deploy.ymldefinition withcomponent=all|shared-resources|agent|frontend|agent-server|function-app|logic-app. The former full-stack, component, shared-resources, Logic App, deployment-owned knowledge-sync, and component-CI entry points were removed. The setup inventory now contains five deployment-related definitions, while existing package-owned CI and knowledge-sync workflows remain separate.smoke-test.yml,smoke-test.ps1, andswap-slot.ymlare deployment-specific rollout helpers, but the active orchestrator does not currently compose them; the process above describes the active path only.Validation
Rollout notes