Merge pull request #325 from microsoft/main

fix: downmerge from main to dev

Author: Avijit-Microsoft

.github/CODEOWNERS

@@ -2,4 +2,4 @@
 # Each line is a file pattern followed by one or more owners.
 
 # These owners will be the default owners for everything in the repo.
-* @Avijit-Microsoft @Roopan-Microsoft @Prajwal1-Microsoft @VinaySh-Microsoft @aniaroramsft @Dongbumlee @sethsteenken @toherman-msft @nchandhi @dgp10801
+* @Avijit-Microsoft @Roopan-Microsoft @Prajwal-Microsoft @Vinay-Microsoft @aniaroramsft @Dongbumlee @sethsteenken @toherman-msft @nchandhi @dgp10801

.github/workflows/ci.yml

@@ -14,7 +14,6 @@ on:
     paths:
       - 'infra/**'
       - 'azure.yaml'
-      - 'azure_custom.yaml'
       - 'scripts/**'
       - '.github/workflows/ci.yml'
   pull_request:
@@ -23,7 +22,6 @@ on:
     paths:
       - 'infra/**'
       - 'azure.yaml'
-      - 'azure_custom.yaml'
       - 'scripts/**'
       - '.github/workflows/ci.yml'
   schedule:

azure.yaml

@@ -33,8 +33,8 @@ hooks:
     posix:
       shell: sh
       run: |  
-        echo "==> Building and pushing container images to the dedicated ACR (remote build)"
-        bash ./scripts/deploy_container_images.sh
+        echo "ℹ️  Container images are NOT built automatically. Run the build manually when ready:"
+        echo "    bash ./scripts/acr_build_push.sh"
         echo "-----"
         echo "🧭 Web App Details:"
         echo "✅ Name: $CONTAINER_WEB_APP_NAME"
@@ -50,8 +50,8 @@ hooks:
     windows:
       shell: pwsh
       run: |  
-        Write-Host "==> Building and pushing container images to the dedicated ACR (remote build)"
-        ./scripts/deploy_container_images.ps1
+        Write-Host "ℹ️  Container images are NOT built automatically. Run the build manually when ready:"
+        Write-Host "    ./scripts/acr_build_push.ps1"
         Write-Host "-----"
         Write-Host "🧭 Web App Details:"
         Write-Host "✅ Name: $env:CONTAINER_WEB_APP_NAME"

azure_custom.yaml

@@ -294,7 +294,21 @@ azd up
 
 **⚠️ Deployment Issues:** If you encounter errors or timeouts, try a different region as there may be capacity constraints. For detailed error solutions, see our [Troubleshooting Guide](./TroubleShootingSteps.md).
 
-### 4.3 Get Application URL
+### 4.3 Run the script to build and push the application images
+
+Build and push the frontend, backend, and processor images to the dedicated ACR, then update the Container Apps to use them. This step is **not run automatically** by `azd up` — run it from the repository root after deployment:
+
+```powershell
+# PowerShell
+./scripts/acr_build_push.ps1
+```
+
+```bash
+# Bash
+bash ./scripts/acr_build_push.sh
+```
+
+### 4.4 Get Application URL
 
 After successful deployment:
 1. Open [Azure Portal](https://portal.azure.com/)
@@ -315,7 +329,7 @@ After successful deployment:
 
 ### 5.2 Verify Deployment
 
-1. Access your application using the URL from Step 4.3
+1. Access your application using the URL from Step 4.4
 2. Confirm the application loads successfully
 3. Verify you can sign in with your authenticated account
 
@@ -460,64 +474,4 @@ Now that your deployment is complete and tested, explore these resources to enha
 
 - 🐛 **Issues:** Check [Troubleshooting Guide](./TroubleShootingSteps.md)
 - 💬 **Support:** Review [Support Guidelines](../SUPPORT.md)
-- 🔧 **Development:** See [Contributing Guide](../CONTRIBUTING.md)
-
----
-
-## Advanced: Deploy Local Changes
-
-If you've made local modifications to the code and want to deploy them to Azure, follow these steps to swap the configuration files so that `azd up` builds Docker images from your local source code instead of pulling pre-built images from the GitHub repository.
-
-**How it works:**
-- The custom `azure.yaml` defines three services (backend, processor, frontend) with `remoteBuild: true`, which instructs `azd` to build Docker images from your local `src/` directories and push them to Azure Container Registry (ACR).
-- The custom `main.bicep` accepts image name parameters (`backendImageName`, `processorImageName`, `frontendImageName`) that `azd` passes automatically after building the images.
-
-> **Note:** To set up and run the application locally for development, see the [Local Development Setup Guide](./LocalDevelopmentSetup.md).
-
-### Step 1: Rename Azure Configuration Files
-
-**In the root directory:**
-1. Rename `azure.yaml` to `azure_custom2.yaml`
-2. Rename `azure_custom.yaml` to `azure.yaml`
-
-### Step 2: Rename Infrastructure Files
-
-**In the `infra` directory:**
-1. Rename `main.bicep` to `main_custom2.bicep`
-2. Rename `main_custom.bicep` to `main.bicep`
-
-### Step 3: Deploy Changes
-
-> ⚠️ **Critical: Redeployment Warning**  
-> If you have previously run `azd up` in this folder (i.e., a `.azure` folder exists), you must create a fresh environment before deploying to avoid conflicts and deployment failures.
-
-**Create a fresh environment:**
-```shell
-# Create a new named environment (3-16 characters, alphanumeric only)
-azd env new <new-environment-name>
-```
-
-> **Note:** When prompted "Set new environment as default environment?", select **Y**. This eliminates the need to run `azd env select` separately.
-
-**Run the deployment:**
-```shell
-azd up
-```
-
-> **Note:** During the packaging phase, you may see `"No artifacts were found"` for each service. This is expected — because `remoteBuild: true` is configured, Docker images are built remotely on Azure Container Registry, not on your local machine. Your local code is still being deployed.
-
-**⚠️ Deployment Issues:** If `azd up` fails on the first attempt (e.g., with a `ResourceNotFound` error), try running `azd up` again. Transient errors can occur due to resource propagation delays, and a retry typically resolves them. For other errors, try a different region or see the [Troubleshooting Guide](./TroubleShootingSteps.md).
-
-### Step 4: Revert Configuration Files
-
-After your custom deployment is complete, revert the renames to restore the original configuration:
-
-**In the root directory:**
-1. Rename `azure.yaml` to `azure_custom.yaml`
-2. Rename `azure_custom2.yaml` to `azure.yaml`
-
-**In the `infra` directory:**
-1. Rename `main.bicep` to `main_custom.bicep`
-2. Rename `main_custom2.bicep` to `main.bicep`
-
-> **Note:** This restores the original files so that standard deployments and git status remain clean.
+- 🔧 **Development:** See [Contributing Guide](../CONTRIBUTING.md)

docs/DeploymentGuide.md

@@ -45,12 +45,12 @@ param azureAiServiceLocation string
 #disable-next-line no-unused-params
 param containerRegistryEndpoint string = ''
 
-@description('Optional. The image tag to use for container images. Defaults to "latest_v2".')
-param imageTag string = 'latest_v2'
+@description('Optional. The image tag to use for container images. Defaults to "latest".')
+param imageTag string = 'latest'
 
 @description('''Optional. Placeholder container image used to initially provision the container apps.
-The dedicated Azure Container Registry is empty right after infrastructure provisioning, so a public image is used as the default allowed image until the post-deployment script (scripts/deploy_container_images.*) builds and pushes the deployment-specific images and updates the apps. Defaults to the Azure Container Apps quickstart image.''')
-param placeholderContainerImage string = 'mcr.microsoft.com/k8se/quickstart:latest'
+The dedicated Azure Container Registry is empty right after infrastructure provisioning, so a public image is used as the default allowed image until the post-deployment script (scripts/acr_build_push.*) builds and pushes the deployment-specific images and updates the apps. Defaults to the Azure Container Apps hello-world image.''')
+param placeholderContainerImage string = 'mcr.microsoft.com/azuredocs/containerapps-helloworld:latest'
 
 @minLength(1)
 @allowed(['Standard', 'GlobalStandard'])
@@ -236,13 +236,19 @@ module containerRegistry './modules/containerRegistry.bicep' = {
     name: containerRegistryName
     location: solutionLocation
     tags: allTags
-    // Premium SKU in WAF/private-networking mode (supports higher throughput and
-    // future private endpoints). Public network access is kept Enabled in both
-    // modes so remote `az acr build` (ACR Tasks) and managed-identity pulls work;
-    // AzureServices bypass lets trusted ACR Tasks reach the registry.
+    // Premium SKU in WAF/private-networking mode (required for private endpoints
+    // and network rule sets). In WAF mode public network access is Disabled at
+    // rest; runtime pulls flow over a private endpoint and the post-deploy build
+    // script temporarily re-enables public access for the remote `az acr build`.
     sku: enablePrivateNetworking ? 'Premium' : 'Standard'
-    publicNetworkAccess: 'Enabled'
+    publicNetworkAccess: enablePrivateNetworking ? 'Disabled' : 'Enabled'
     networkRuleBypassOptions: 'AzureServices'
+    // WAF: host the registry private endpoint in the backend subnet and link it
+    // to the privatelink.azurecr.io DNS zone so image pulls resolve privately.
+    // Reference the VNet and DNS zone outputs directly to avoid case-sensitivity
+    // issues with manually constructed resource IDs.
+    privateEndpointSubnetResourceId: enablePrivateNetworking ? virtualNetwork!.outputs.backendSubnetResourceId : ''
+    privateDnsZoneResourceId: enablePrivateNetworking ? avmPrivateDnsZones[dnsZoneIndex.containerRegistry]!.outputs.resourceId : ''
     // Application managed identity gets AcrPull for identity-based image pulls.
     acrPullPrincipalIds: [
       appIdentity.outputs.principalId
@@ -605,6 +611,7 @@ var privateDnsZones = [
   'privatelink.blob.${environment().suffixes.storage}'
   'privatelink.queue.${environment().suffixes.storage}'
   'privatelink.azconfig.io'
+  'privatelink.azurecr.io'
 ]
 
 // DNS Zone Index Constants
@@ -616,6 +623,7 @@ var dnsZoneIndex = {
   storageBlob: 4
   storageQueue: 5
   appConfig: 6
+  containerRegistry: 7
 }
 
 // List of DNS zone indices that correspond to AI-related services.