Sync toolkit modules and align DEPLOYMENT_FLAVOR env var with agentic PR

- Sync container-registry.bicep (avm + bicep): SKU default Standard, retention policy
- Sync cosmos-db-mongo.bicep (avm): networkAclBypass AzureServices
- Rename AZURE_ENV_DEPLOYMENT_FLAVOR to DEPLOYMENT_FLAVOR in main.parameters.json

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Author: Prachig-Microsoft

infra/avm/modules/compute/container-registry.bicep

@@ -17,7 +17,7 @@ param tags object = {}
 
 @description('SKU for the container registry.')
 @allowed(['Basic', 'Standard', 'Premium'])
-param sku string = 'Premium'
+param sku string = 'Standard'
 
 @description('Enable admin user for the registry.')
 param adminUserEnabled bool = false
@@ -32,6 +32,14 @@ param exportPolicyStatus string = 'enabled'
 @description('Principal IDs to assign AcrPull role.')
 param acrPullPrincipalIds array = []
 
+// Additive: AcrPush for deployer so post-deploy docker push works without manual RBAC.
+@description('Principal IDs to assign AcrPush role (typically the deployer).')
+param acrPushPrincipalIds array = []
+
+@description('Principal type for AcrPush assignments (User for azd user, ServicePrincipal for CI).')
+@allowed(['User', 'ServicePrincipal', 'Group'])
+param acrPushPrincipalType string = 'User'
+
 @description('Enable private networking.')
 param enablePrivateNetworking bool = false
 
@@ -52,13 +60,25 @@ param enableTelemetry bool = true
 // Role Assignments
 // ============================================================================
 var acrPullRoleId = '7f951dda-4ed3-4680-a7ca-43fe172d538d'
+var acrPushRoleId = '8311e382-0749-4cb8-b61a-304f252e45ec'
 
-var roleAssignments = [for principalId in acrPullPrincipalIds: {
+var pullRoleAssignments = [for principalId in acrPullPrincipalIds: {
   principalId: principalId
   roleDefinitionIdOrName: acrPullRoleId
   principalType: 'ServicePrincipal'
 }]
 
+var pushRoleAssignments = [for principalId in acrPushPrincipalIds: {
+  principalId: principalId
+  roleDefinitionIdOrName: acrPushRoleId
+  principalType: acrPushPrincipalType
+}]
+
+var roleAssignments = concat(
+  !empty(acrPullPrincipalIds) ? pullRoleAssignments : [],
+  !empty(acrPushPrincipalIds) ? pushRoleAssignments : []
+)
+
 // ============================================================================
 // Private Endpoint Config
 // ============================================================================
@@ -90,7 +110,7 @@ module containerRegistry 'br/public:avm/res/container-registry/registry:0.12.1'
     acrAdminUserEnabled: adminUserEnabled
     publicNetworkAccess: publicNetworkAccess
     exportPolicyStatus: exportPolicyStatus
-    roleAssignments: !empty(acrPullPrincipalIds) ? roleAssignments : []
+    roleAssignments: !empty(roleAssignments) ? roleAssignments : []
     privateEndpoints: privateEndpointConfig
     networkRuleSetDefaultAction: networkRuleSetDefaultAction
   }

infra/avm/modules/data/cosmos-db-mongo.bicep

@@ -91,7 +91,7 @@ module cosmosAccount 'br/public:avm/res/document-db/database-account:0.19.0' = {
     ]
     diagnosticSettings: !empty(diagnosticSettings) ? diagnosticSettings : []
     networkRestrictions: {
-      networkAclBypass: 'None'
+      networkAclBypass: 'AzureServices'
       publicNetworkAccess: publicNetworkAccess
     }
     privateEndpoints: enablePrivateNetworking ? [

infra/bicep/modules/compute/container-registry.bicep

@@ -18,7 +18,7 @@ param tags object = {}
 
 @description('SKU for the container registry.')
 @allowed(['Basic', 'Standard', 'Premium'])
-param sku string = 'Premium'
+param sku string = 'Standard'
 
 @description('Enable admin user.')
 param adminUserEnabled bool = false
@@ -30,6 +30,9 @@ param publicNetworkAccess string = 'Enabled'
 @description('Export policy status.')
 param exportPolicyStatus string = 'enabled'
 
+@description('Retention policy status.')
+param retentionPolicyStatus string = 'disabled'
+
 // ============================================================================
 // Resource Deployment
 // ============================================================================
@@ -50,7 +53,7 @@ resource containerRegistry 'Microsoft.ContainerRegistry/registries@2025-04-01' =
         status: exportPolicyStatus
       }
       retentionPolicy: {
-        status: 'enabled'
+        status: retentionPolicyStatus
         days: 7
       }
       trustPolicy: {
@@ -72,4 +75,4 @@ output name string = containerRegistry.name
 output loginServer string = containerRegistry.properties.loginServer
 
 @description('The resource ID of the container registry.')
-output resourceId string = containerRegistry.id
+output resourceId string = containerRegistry.id

infra/main.parameters.json

@@ -3,7 +3,7 @@
     "contentVersion": "1.0.0.0",
     "parameters": {
       "deploymentFlavor": {
-        "value": "${AZURE_ENV_DEPLOYMENT_FLAVOR}"
+        "value": "${DEPLOYMENT_FLAVOR=bicep}"
       },
       "solutionName": {
         "value": "${AZURE_ENV_NAME}"