ci: simplify deploy workflows — Terraform owns Container App config, CI owns image version

[BenjaminMichaelis]

Summary

Now that Terraform manages the Container App configuration, the deploy jobs no longer need to re-configure identity, registry, secrets, or env vars on every run. This PR strips those steps and adds production hardening.

What changed

Removed (Terraform owns these now)

• az containerapp identity assign — UAMI is set in Terraform HCL
• az containerapp registry set — ACR pull via managed identity is in Terraform HCL
• az containerapp secret set — all Key Vault secret refs are in Terraform HCL
• --replace-env-vars on az containerapp update — env vars are in Terraform HCL

Changed

• deploy-development: now just loads artifact → pushes to dev ACR → az containerapp update --image :sha
• deploy-production: replaced artifact download + push with az acr import (server-side copy from dev ACR to prod ACR — faster, no large artifact download)
• Build job: removed prod registry tags (image only goes to dev ACR at build time; prod gets it via import)

Added (production hardening)

• Deploy by image digest (@sha256:...) instead of mutable tag — immutable reference
• Post-deploy image verification — reads deployed image from Container App, asserts it matches expected digest; catches silent rollback if Terraform recreates the resource
• Smoke test — curl --fail /health on the Container App FQDN
• Git deploy tag — deployed/prod/<sha> pushed to repo as a durable audit record

Prerequisites (confirm before merging)

Verify Terraform HCL for the web Container App has all of:

• identity { user_assigned_identity_ids = [...] } — UAMI attached
• registry { ... identity = uami_id } — ACR pull via managed identity
• All 14 secrets as Key Vault refs under secret { key_vault_secret_uri }
• All env vars under template.container.env
• OIDC identity has AcrPush (or AcrImporter) on prod ACR for az acr import

RBAC note

The OIDC identity for this repo needs AcrPush on the prod ACR in addition to the dev ACR — az acr import writes to prod. Terraform should own this role assignment.

[Copilot]

Pull request overview

This PR simplifies the CI/CD workflow by removing Azure Container App configuration steps from deploy jobs (now owned by Terraform) and hardening production deployments by deploying via immutable image digests with post-deploy verification and a basic smoke test.

Changes:

• Build job now tags/publishes images only to the dev ACR; production receives images via az acr import.
• Deploy jobs now only update Container App image (no identity/registry/secrets/env-var configuration in CI).
• Production deploy adds digest-based deploy, deployed-image verification, /health smoke test, and a Git deploy tag.

[BenjaminMichaelis]

Both review comments have been addressed in the latest commit (8f096ba):

1. Empty digest guard — added explicit [ -z "$DIGEST" ] && exit 1 with a clear ::error:: annotation immediately after az acr repository show so the workflow fails fast with a meaningful message instead of propagating an invalid image reference.

2. Non-idempotent git tag — switched to git tag -f + git push --force with git config user.email/name set, so workflow re-runs for the same SHA don't fail on the tag step.

Both review threads are marked as outdated since the code was updated. Also in the same commit: replaced deprecated az acr repository show-manifests with az acr repository show, added --registry to az acr import for explicit ARM auth on the source ACR, and improved curl to retry on HTTP 5xx (--retry-all-errors).