Separate Azure Envs for Dev/Prod

.azure/app-insights.bicep

@@ -1,17 +1,28 @@
 @description('Location for Application Insights')
 param location string = resourceGroup().location
 
+@description('Environment name (dev or prod)')
+@allowed([
+  'dev'
+  'prod'
+])
+param environmentName string
+
 @description('Tags to apply to resources')
 param tags object = {}
 
 var appInsightsName = 'yolo-funk-insights'
 var logAnalyticsName = 'yolo-funk-logs'
+var resourceTags = union(tags, {
+  Environment: environmentName
+  ManagedBy: 'GitHub'
+})
 
 // Log Analytics Workspace (required for Application Insights)
 resource logAnalytics 'Microsoft.OperationalInsights/workspaces@2023-09-01' = {
   name: logAnalyticsName
   location: location
-  tags: tags
+  tags: resourceTags
   properties: {
     sku: {
       name: 'PerGB2018'
@@ -20,11 +31,10 @@ resource logAnalytics 'Microsoft.OperationalInsights/workspaces@2023-09-01' = {
   }
 }
 
-// Application Insights (shared across all environments)
 resource appInsights 'Microsoft.Insights/components@2020-02-02' = {
   name: appInsightsName
   location: location
-  tags: tags
+  tags: resourceTags
   kind: 'web'
   properties: {
     Application_Type: 'web'

.azure/function-app.bicep

@@ -1,4 +1,8 @@
-@description('Environment name (dev, prod, or pr-{number})')
+@description('Environment name (dev or prod)')
+@allowed([
+  'dev'
+  'prod'
+])
 param environmentName string
 
 @description('Location for all resources')
@@ -11,26 +15,20 @@ param location string = resourceGroup().location
 ])
 param hyperliquidNetwork string = 'testnet'
 
-@description('Key Vault name for secrets (optional)')
-param keyVaultName string = ''
+@description('Name of the Key Vault dedicated to this environment')
+param keyVaultName string
 
 @description('Tags to apply to all resources')
 param tags object = {}
 
 var functionAppName = 'yolo-funk-${environmentName}'
 var storageAccountName = 'yolofunk${uniqueString(resourceGroup().id, environmentName)}'
 var appInsightsName = 'yolo-funk-insights'
-var contentShareName = contains([
-  'dev'
-  'prod'
-], environmentName) ? toLower(functionAppName) : 'yolofunk${uniqueString(resourceGroup().id, environmentName)}'
-
-// Determine secret suffix based on network (testnet or mainnet)
-var secretEnv = hyperliquidNetwork == 'mainnet' ? 'prod' : 'dev'
+var contentShareName = toLower(functionAppName)
 var useTestnet = hyperliquidNetwork == 'mainnet' ? 'false' : 'true'
 
 // Key Vault reference helper
-var keyVaultUri = !empty(keyVaultName) ? 'https://${keyVaultName}${environment().suffixes.keyvaultDns}' : ''
+var keyVaultUri = 'https://${keyVaultName}${environment().suffixes.keyvaultDns}'
 
 // Merge environment tags with provided tags
 var resourceTags = union(tags, {
@@ -54,7 +52,7 @@ resource storageAccount 'Microsoft.Storage/storageAccounts@2023-01-01' = {
   }
 }
 
-// Application Insights (shared across environments for cost savings)
+// Each environment has an identically named instance in its own resource group.
 resource appInsights 'Microsoft.Insights/components@2020-02-02' existing = {
   name: appInsightsName
 }
@@ -122,57 +120,43 @@ resource functionApp 'Microsoft.Web/sites@2023-01-01' = {
         }
         {
           name: 'Strategies__YoloDaily__Hyperliquid__Address'
-          value: !empty(keyVaultName)
-            ? '@Microsoft.KeyVault(SecretUri=${keyVaultUri}/secrets/hyperliquid-${secretEnv}-agent-address/)'
-            : ''
+          value: '@Microsoft.KeyVault(SecretUri=${keyVaultUri}/secrets/hyperliquid-agent-address/)'
         }
         {
           name: 'Strategies__YoloDaily__Hyperliquid__PrivateKey'
-          value: !empty(keyVaultName)
-            ? '@Microsoft.KeyVault(SecretUri=${keyVaultUri}/secrets/hyperliquid-${secretEnv}-agent-privatekey/)'
-            : ''
+          value: '@Microsoft.KeyVault(SecretUri=${keyVaultUri}/secrets/hyperliquid-agent-privatekey/)'
         }
         {
           name: 'Strategies__YoloDaily__Hyperliquid__VaultAddress'
-          value: !empty(keyVaultName)
-            ? '@Microsoft.KeyVault(SecretUri=${keyVaultUri}/secrets/hyperliquid-${secretEnv}-vault-yolodaily/)'
-            : ''
+          value: '@Microsoft.KeyVault(SecretUri=${keyVaultUri}/secrets/hyperliquid-vault-yolodaily/)'
         }
         {
           name: 'Strategies__YoloDaily__Hyperliquid__UseTestnet'
           value: useTestnet
         }
         {
           name: 'Strategies__UnravelDaily__Hyperliquid__Address'
-          value: !empty(keyVaultName)
-            ? '@Microsoft.KeyVault(SecretUri=${keyVaultUri}/secrets/hyperliquid-${secretEnv}-agent-address/)'
-            : ''
+          value: '@Microsoft.KeyVault(SecretUri=${keyVaultUri}/secrets/hyperliquid-agent-address/)'
         }
         {
           name: 'Strategies__UnravelDaily__Hyperliquid__PrivateKey'
-          value: !empty(keyVaultName)
-            ? '@Microsoft.KeyVault(SecretUri=${keyVaultUri}/secrets/hyperliquid-${secretEnv}-agent-privatekey/)'
-            : ''
+          value: '@Microsoft.KeyVault(SecretUri=${keyVaultUri}/secrets/hyperliquid-agent-privatekey/)'
         }
         {
           name: 'Strategies__UnravelDaily__Hyperliquid__VaultAddress'
-          value: !empty(keyVaultName)
-            ? '@Microsoft.KeyVault(SecretUri=${keyVaultUri}/secrets/hyperliquid-${secretEnv}-vault-unraveldaily/)'
-            : ''
+          value: '@Microsoft.KeyVault(SecretUri=${keyVaultUri}/secrets/hyperliquid-vault-unraveldaily/)'
         }
         {
           name: 'Strategies__UnravelDaily__Hyperliquid__UseTestnet'
           value: useTestnet
         }
         {
           name: 'Strategies__YoloDaily__RobotWealth__ApiKey'
-          value: !empty(keyVaultName)
-            ? '@Microsoft.KeyVault(SecretUri=${keyVaultUri}/secrets/robotwealth-api-key/)'
-            : ''
+          value: '@Microsoft.KeyVault(SecretUri=${keyVaultUri}/secrets/robotwealth-api-key/)'
         }
         {
           name: 'Strategies__UnravelDaily__Unravel__ApiKey'
-          value: !empty(keyVaultName) ? '@Microsoft.KeyVault(SecretUri=${keyVaultUri}/secrets/unravel-api-key/)' : ''
+          value: '@Microsoft.KeyVault(SecretUri=${keyVaultUri}/secrets/unravel-api-key/)'
         }
         {
           name: 'Strategies__YoloDaily__Schedule'

.azure/key-vault.bicep

@@ -0,0 +1,48 @@
+@description('Globally unique Key Vault name for this environment')
+param keyVaultName string
+
+@description('Environment name (dev or prod)')
+@allowed([
+  'dev'
+  'prod'
+])
+param environmentName string
+
+@description('Location for the Key Vault')
+param location string = resourceGroup().location
+
+@description('Tags to apply to the Key Vault')
+param tags object = {}
+
+resource keyVault 'Microsoft.KeyVault/vaults@2023-07-01' = {
+  name: keyVaultName
+  location: location
+  tags: union(tags, {
+    Environment: environmentName
+    ManagedBy: 'GitHub'
+  })
+  properties: {
+    tenantId: subscription().tenantId
+    enableRbacAuthorization: true
+    enableSoftDelete: true
+    softDeleteRetentionInDays: 90
+    enablePurgeProtection: true
+    // GitHub-hosted runners and operator workstations do not have stable egress IPs.
+    // Keep the data-plane endpoint public; Entra authentication and vault-scoped RBAC
+    // remain mandatory for both deployments and manual secret maintenance.
+    publicNetworkAccess: 'Enabled'
+    networkAcls: {
+      bypass: 'None'
+      defaultAction: 'Allow'
+      ipRules: []
+      virtualNetworkRules: []
+    }
+    sku: {
+      family: 'A'
+      name: 'standard'
+    }
+  }
+}
+
+output keyVaultId string = keyVault.id
+output keyVaultUri string = keyVault.properties.vaultUri

.github/dependabot.yml

@@ -7,5 +7,6 @@ version: 2
 updates:
   - package-ecosystem: "nuget" # See documentation for possible values
     directory: "/" # Location of package manifests
+    target-branch: "develop"
     schedule:
       interval: "weekly"