Migrate to GPT-5.4 models and refactor deployment

Broad update aligning the accelerator with GPT-5.4/GPT-5.4-mini models and a refactored deployment pipeline:

- Update all Bicep/ARM templates, params, docs, and quota scripts to deploy `gpt-5.4` and `gpt-5.4-mini` (replacing gpt-4.1/o4-mini), with capacities 150/100.
- Add Azure Container Registry provisioning/reuse to AVM and vanilla Bicep, with ACR pull role assignments and managed-identity image pulls; add `Build-And-Push-Images` post-provision scripts (PS1/sh) and `azure.yaml` postdeploy hooks.
- Rework CI workflows (azure-dev, deploy, deploy-waf, docker-build) to use OIDC login, new capacity vars, owner tags; remove create-release workflow.
- Rewrite DeploymentGuide with step-by-step environment options.
- Backend: add ImageAgent, markdown table normalization, human-readable agent display names, mandatory-agent plan enforcement, auto-approve replans, and elapsed-time UI indicators.
- Frontend: resolve API asset URLs for images, persist/restore selected team, add ProcessingStatusIndicator and elapsed timers.
- Update tests accordingly.

Author: Fr4nc3

.github/workflows/azd-template-validation.yml

@@ -34,7 +34,7 @@ jobs:
           AZURE_LOCATION: ${{ vars.AZURE_LOCATION }}
           AZURE_ENV_AI_SERVICE_LOCATION: ${{ vars.AZURE_AI_DEPLOYMENT_LOCATION }}
           AZURE_ENV_GPT_MODEL_CAPACITY: 1
-          AZURE_ENV_MODEL_4_1_CAPACITY: 1 # keep low to avoid potential quota issues
+          AZURE_ENV_MODEL_5_4_CAPACITY: 1 # keep low to avoid potential quota issues
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
 
       - name: print result

.github/workflows/azure-dev.yml

@@ -1,29 +1,59 @@
-name: Azure Template Validation
+name: Azure Dev Deploy
+
 on:
   workflow_dispatch:
 
 permissions:
   contents: read
   id-token: write
-  pull-requests: write
 
 jobs:
-  template_validation_job:
+  deploy:
     runs-on: ubuntu-latest
-    name: template validation
+    environment: production
+    env:
+      AZURE_CLIENT_ID: ${{ secrets.AZURE_CLIENT_ID }}
+      AZURE_TENANT_ID: ${{ secrets.AZURE_TENANT_ID }}
+      AZURE_SUBSCRIPTION_ID: ${{ secrets.AZURE_SUBSCRIPTION_ID }}
+      AZURE_LOCATION: ${{ vars.AZURE_LOCATION }}
+      AZURE_ENV_AI_SERVICE_LOCATION: ${{ vars.AZURE_AI_DEPLOYMENT_LOCATION }}
+      AZURE_ENV_GPT_MODEL_CAPACITY: 1
+      AZURE_ENV_MODEL_5_4_CAPACITY: 1
+      GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+      AZURE_DEV_COLLECT_TELEMETRY: ${{ vars.AZURE_DEV_COLLECT_TELEMETRY }}
     steps:
-      - uses: actions/checkout@v4
-
-      - uses: microsoft/template-validation-action@Latest
-        id: validation
-        env:
-          AZURE_CLIENT_ID: ${{ vars.AZURE_CLIENT_ID }}
-          AZURE_TENANT_ID: ${{ vars.AZURE_TENANT_ID }}
-          AZURE_SUBSCRIPTION_ID: ${{ vars.AZURE_SUBSCRIPTION_ID }}
-          AZURE_ENV_NAME: ${{ vars.AZURE_ENV_NAME }}
-          AZURE_LOCATION: ${{ vars.AZURE_LOCATION }}
-          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-          AZURE_DEV_COLLECT_TELEMETRY: ${{ vars.AZURE_DEV_COLLECT_TELEMETRY }}
-
-      - name: print result
-        run: cat ${{ steps.validation.outputs.resultFile }}
+      - name: Checkout Code
+        uses: actions/checkout@v6
+
+      - name: Set timestamp and env name
+        run: |
+          HHMM=$(date -u +'%H%M')
+          echo "AZURE_ENV_NAME=azd-${{ vars.AZURE_ENV_NAME }}-${HHMM}" >> $GITHUB_ENV
+
+      - name: Install azd
+        uses: Azure/setup-azd@v2
+
+      - name: Login to Azure
+        uses: azure/login@v3
+        with:
+          client-id: ${{ secrets.AZURE_CLIENT_ID }}
+          tenant-id: ${{ secrets.AZURE_TENANT_ID }}
+          subscription-id: ${{ secrets.AZURE_SUBSCRIPTION_ID }}
+
+      - name: Login to AZD
+        shell: bash
+        run: |
+          azd auth login \
+            --client-id "$AZURE_CLIENT_ID" \
+            --federated-credential-provider "github" \
+            --tenant-id "$AZURE_TENANT_ID"
+
+      - name: Provision and Deploy
+        shell: bash
+        run: |
+          if ! azd env select "$AZURE_ENV_NAME"; then
+            azd env new "$AZURE_ENV_NAME" --subscription "$AZURE_SUBSCRIPTION_ID" --location "$AZURE_LOCATION" --no-prompt
+          fi
+          azd config set defaults.subscription "$AZURE_SUBSCRIPTION_ID"
+          azd env set AZURE_ENV_AI_SERVICE_LOCATION="$AZURE_ENV_AI_SERVICE_LOCATION"
+          azd up --no-prompt

.github/workflows/create-release.yml

@@ -1,33 +1,52 @@
-name: Validate WAF Deployment
+name: Validate WAF Deployment v4
 
+permissions:
+  id-token: write
+  contents: read
+  actions: read
 on:
   push:
     branches:
       - main
+    paths:
+      - 'src/**'
+      - 'infra/**'
+      - 'azure.yaml'
+      - 'azure_custom.yaml'
+      - '.github/workflows/deploy-waf.yml'
   schedule:
     - cron: "0 11,23 * * *" # Runs at 11:00 AM and 11:00 PM GMT
 
 jobs:
   deploy:
     runs-on: ubuntu-latest
+    environment: production
+    env:
+      GPT_5_4_MINI_MIN_CAPACITY: 1
+      GPT_5_4_MIN_CAPACITY: 1
     steps:
       - name: Checkout Code
-        uses: actions/checkout@v3
+        uses: actions/checkout@v6
+
+      - name: Login to Azure
+        uses: azure/login@v3
+        with:
+          client-id: ${{ secrets.AZURE_CLIENT_ID }}
+          tenant-id: ${{ secrets.AZURE_TENANT_ID }}
+          subscription-id: ${{ secrets.AZURE_SUBSCRIPTION_ID }}
 
       - name: Run Quota Check
         id: quota-check
+        env:
+          AZURE_SUBSCRIPTION_ID: ${{ secrets.AZURE_SUBSCRIPTION_ID }}
+          GPT_5_4_MINI_MIN_CAPACITY: ${{ env.GPT_5_4_MINI_MIN_CAPACITY }}
+          GPT_5_4_MIN_CAPACITY: ${{ env.GPT_5_4_MIN_CAPACITY }}
+          AZURE_REGIONS: ${{ vars.AZURE_REGIONS }}
         run: |
-          export AZURE_CLIENT_ID=${{ secrets.AZURE_CLIENT_ID }}
-          export AZURE_TENANT_ID=${{ secrets.AZURE_TENANT_ID }}
-          export AZURE_CLIENT_SECRET=${{ secrets.AZURE_CLIENT_SECRET }}
-          export AZURE_SUBSCRIPTION_ID="${{ secrets.AZURE_SUBSCRIPTION_ID }}"
-          export GPT_MIN_CAPACITY="150"
-          export AZURE_REGIONS="${{ vars.AZURE_REGIONS }}"
-
-          chmod +x infra/scripts/checkquota.sh
-          if ! infra/scripts/checkquota.sh; then
+          chmod +x infra/scripts/pre-provision/checkquota.sh
+          if ! infra/scripts/pre-provision/checkquota.sh; then
             # If quota check fails due to insufficient quota, set the flag
-            if grep -q "No region with sufficient quota found" infra/scripts/checkquota.sh; then
+            if grep -q "No region with sufficient quota found" infra/scripts/pre-provision/checkquota.sh; then
               echo "QUOTA_FAILED=true" >> $GITHUB_ENV
             fi
             exit 1  # Fail the pipeline if any other failure occurs
@@ -57,15 +76,6 @@ jobs:
           echo "Selected Region: $VALID_REGION"
           echo "AZURE_LOCATION=$VALID_REGION" >> $GITHUB_ENV
 
-      - name: Setup Azure CLI
-        run: |
-          curl -sL https://aka.ms/InstallAzureCLIDeb | sudo bash
-          az --version  # Verify installation
-
-      - name: Login to Azure
-        run: |
-          az login --service-principal -u ${{ secrets.AZURE_CLIENT_ID }} -p ${{ secrets.AZURE_CLIENT_SECRET }} --tenant ${{ secrets.AZURE_TENANT_ID }}
-
       - name: Install Bicep CLI
         run: az bicep install
 
@@ -82,14 +92,19 @@ jobs:
       - name: Check and Create Resource Group
         id: check_create_rg
         run: |
-          set -e  
-          echo "Checking if resource group exists..."
+          set -e
+          OWNER_TAG_VALUE="${{ github.actor }}"
+          echo "🔍 Checking if resource group '${{ env.RESOURCE_GROUP_NAME }}' exists..."
           rg_exists=$(az group exists --name ${{ env.RESOURCE_GROUP_NAME }})
           if [ "$rg_exists" = "false" ]; then
-            echo "Resource group does not exist. Creating..."
-            az group create --name ${{ env.RESOURCE_GROUP_NAME }} --location ${{ env.AZURE_LOCATION }} || { echo "Error creating resource group"; exit 1; }
+            echo "📦 Resource group does not exist. Creating new resource group '${{ env.RESOURCE_GROUP_NAME }}' in location '${{ env.AZURE_LOCATION }}'..."
+            echo "🏷️  Adding Owner tag: Owner=${OWNER_TAG_VALUE}"
+            az group create --name ${{ env.RESOURCE_GROUP_NAME }} --location ${{ env.AZURE_LOCATION }} --tags "Owner=${OWNER_TAG_VALUE}" || { echo "❌ Error creating resource group"; exit 1; }
+            echo "✅ Resource group '${{ env.RESOURCE_GROUP_NAME }}' created successfully."
           else
-            echo "Resource group already exists."
+            echo "✅ Resource group '${{ env.RESOURCE_GROUP_NAME }}' already exists."
+            echo "🏷️  Merging Owner tag on existing resource group: Owner=${OWNER_TAG_VALUE}"
+            az group update --name "${{ env.RESOURCE_GROUP_NAME }}" --set tags.Owner="${OWNER_TAG_VALUE}" --output none || echo "⚠️  Warning: failed to update Owner tag on existing resource group '${{ env.RESOURCE_GROUP_NAME }}'."
           fi
 
       - name: Generate Unique Solution Prefix
@@ -105,23 +120,25 @@ jobs:
         id: deploy
         run: |
           set -e
-           # Generate current timestamp in desired format: YYYY-MM-DDTHH:MM:SS.SSSSSSSZ
+
+          # Generate current timestamp in desired format: YYYY-MM-DDTHH:MM:SS.SSSSSSSZ
             current_date=$(date -u +"%Y-%m-%dT%H:%M:%S.%7NZ")
-          
+
           az deployment group create \
             --resource-group ${{ env.RESOURCE_GROUP_NAME }} \
             --template-file infra/main.bicep \
             --parameters \
               solutionName=${{ env.SOLUTION_PREFIX }} \
               location="${{ env.AZURE_LOCATION }}" \
               azureAiServiceLocation='${{ env.AZURE_LOCATION }}' \
-              gptModelCapacity=5 \
+              gptDeploymentCapacity=${{ env.GPT_5_4_MINI_MIN_CAPACITY }} \
+              gpt5_4ModelCapacity=${{ env.GPT_5_4_MIN_CAPACITY }} \
               enableTelemetry=true \
               enableMonitoring=true \
               enablePrivateNetworking=true \
               enableScalability=true \
               createdBy="Pipeline" \
-              tags="{'SecurityControl':'Ignore','Purpose':'Deploying and Cleaning Up Resources for Validation','CreatedDate':'$current_date'}"
+              tags="{'Purpose':'Deploying and Cleaning Up Resources for Validation','CreatedDate':'$current_date'}"
               
 
       - name: Send Notification on Failure