feat(workflows): auto-update APP_URL secrets from deploy-all workflow AB#2140

.github/workflows/deploy-all.yml

@@ -195,20 +195,30 @@ jobs:
           echo "### Scanner App" >> $GITHUB_STEP_SUMMARY
           echo "**URL:** [${SCANNER_URL}](${SCANNER_URL})" >> $GITHUB_STEP_SUMMARY
 
-      - name: Update SCANNER_URL secret on all demo app repos
+      - name: Update SCANNER_URL and APP_URL secrets on all demo app repos
         env:
           GH_TOKEN: ${{ secrets.DISPATCH_PAT }}
         run: |
-          SITE_URL=$(az deployment group show \
+          SCANNER_URL=$(az deployment group show \
             --resource-group rg-a11y-scan-demo \
             --name infra-deploy \
             --query 'properties.outputs.webAppUrl.value' -o tsv)
           for i in 001 002 003 004 005; do
             REPO="devopsabcs-engineering/a11y-demo-app-${i}"
-            echo "Setting SCANNER_URL on ${REPO}..."
-            gh secret set SCANNER_URL --repo "$REPO" --body "$SITE_URL"
+            RG="rg-a11y-demo-app-${i}"
+            echo "Updating secrets on ${REPO}..."
+            gh secret set SCANNER_URL --repo "$REPO" --body "$SCANNER_URL"
+            APP_URL=$(az deployment group show \
+              --resource-group "$RG" \
+              --name infra-deploy \
+              --query 'properties.outputs.webAppUrl.value' -o tsv 2>/dev/null || echo "")
+            if [ -n "$APP_URL" ]; then
+              gh secret set APP_URL --repo "$REPO" --body "$APP_URL"
+              echo "  SCANNER_URL and APP_URL set"
+            else
+              echo "  SCANNER_URL set, APP_URL skipped (not deployed)"
+            fi
           done
-          echo "SCANNER_URL updated on all demo app repos: $SITE_URL"
 
   # ── Teardown (requires approval via 'teardown' environment) ──
   teardown: