Fix comments in PR

Ba4bes · Copilot · Ba4bes · commit a8b490a62b66 · 2026-04-24T15:54:36.000+02:00
Co-authored-by: Copilot &lt;copilot@github.com&gt;
diff --git a/ba4bes-unific-travis.sln b/ba4bes-unific-travis.sln
diff --git a/plugin/skills/azure-iac-generator/SKILL.md b/plugin/skills/azure-iac-generator/SKILL.md
@@ -4,7 +4,7 @@ description: "Generate deployment-ready Bicep templates from existing Azure envi
 license: MIT
 metadata:
   author: Microsoft
-  version: "1.0.1"
+  version: "0.0.0-placeholder"
 ---
 
 # Azure IaC Generator
diff --git a/plugin/skills/azure-iac-generator/references/auto-detection-rules.md b/plugin/skills/azure-iac-generator/references/auto-detection-rules.md
@@ -14,4 +14,5 @@ Settings automatically applied based on diagram topology during Bicep generation
 | Private Endpoint exists in a subnet | Set `privateEndpointNetworkPolicies: "Disabled"` on that subnet |
 | VM exists without NIC in diagram | Auto-add NIC resource |
 | App Service exists without App Service Plan | Auto-add App Service Plan |
-| Subnet index N | Set `addressPrefix: "10.0.N.0/24"` (auto-increment) |
+| Subnet index N | Derive `addressPrefix` from the VNet `addressSpace` when present; otherwise require or prompt for a base CIDR before auto-assigning a non-overlapping subnet |  
+
diff --git a/plugin/skills/azure-iac-generator/references/azure-deployment-verification.md b/plugin/skills/azure-iac-generator/references/azure-deployment-verification.md
@@ -1,8 +1,5 @@
 # Azure Deployment Verification Rules
 
-> **Canonical copy:** Shared deployment-verification rules used by Azure IaC skills. Keep local copies aligned when this rule set changes.
-
-
 Shared pre-deployment verification rules for generated Bicep templates. These cover **gotcha-prone constraints** that are easy to miss — SKU dependencies, resource compatibility, and networking rules that cause deployment failures.
 
 For rules not listed here (security defaults like TLS 1.2, HTTPS enforcement, runtime version currency), verify against Bicep MCP `get_az_resource_type_schema`, [bicep-best-practices.md](bicep-best-practices.md), and Microsoft documentation.
diff --git a/plugin/skills/azure-iac-generator/references/azure-resource-model.md b/plugin/skills/azure-iac-generator/references/azure-resource-model.md
@@ -1,10 +1,7 @@
 # Azure Resource Metadata Model
 
-> **Canonical copy:** Shared resource-model schema used across Azure IaC and diagram skills. Keep local copies aligned when this schema changes.
 
 
-Shared internal representation used by AzVerify skills (sketch-to-diagram, diagram-to-bicep, diagram-azure-sync).
-
 ## Schema
 
 Each Azure environment is represented as a **resource model** — a JSON structure with the following shape:
diff --git a/plugin/skills/azure-iac-generator/references/azure-stencil-mapping.json b/plugin/skills/azure-iac-generator/references/azure-stencil-mapping.json
@@ -1,10 +1,4 @@
 {
-  "_canonicalCopy": {
-    "description": "Shared Azure stencil mapping copied into azure-iac-generator so diagram-parsing references resolve locally.",
-    "maintainers": [
-      "Azure IaC skills"
-    ]
-  },
   "resources": [
     {
       "type": "Microsoft.Compute/virtualMachines",
diff --git a/plugin/skills/azure-iac-generator/references/azure-to-bicep-workflow.md b/plugin/skills/azure-iac-generator/references/azure-to-bicep-workflow.md
@@ -63,7 +63,7 @@ Follow [bicep-best-practices.md](bicep-best-practices.md) strictly. Call Bicep M
 | File | Contents |
 |---|---|
 | `main.bicep` | `targetScope = 'resourceGroup'`; all params with `@description()` and `@secure()` where needed; one `module` block per category; outputs for key endpoints/IDs |
-| `<scope>.bicepparam` | `using 'main.bicep'`; every param value matching current Azure config; 1-3 line comments per param (what it controls, alternatives with cost impact, version EOL dates); `readEnvironmentVariable()` for secrets |
+| `main.bicepparam` | `using 'main.bicep'`; every param value matching current Azure config; 1-3 line comments per param (what it controls, alternatives with cost impact, version EOL dates); `readEnvironmentVariable()` for secrets |
 | `modules/networking.bicep` | VNets, subnets, NSGs, private endpoints, NICs, firewalls |
 | `modules/compute.bicep` | VMs, App Services, Functions, Container Apps — follow the runtime defaulting rules in [version-currency.md](version-currency.md) |
 | `modules/data.bicep` | Storage, SQL, Cosmos DB, Redis, Key Vault |
diff --git a/plugin/skills/azure-iac-generator/references/bicep-best-practices.md b/plugin/skills/azure-iac-generator/references/bicep-best-practices.md
@@ -1,6 +1,6 @@
 # Bicep Best Practices
 
-Mandatory rules for all Bicep generation in AzVerify skills. Before generating any Bicep, also call the Bicep MCP server's `get_bicep_best_practices` tool for the latest guidance.
+Mandatory rules for all Bicep generation. Before generating any Bicep, also call the Bicep MCP server's `get_bicep_best_practices` tool for the latest guidance.
 
 ---
 
diff --git a/plugin/skills/azure-iac-generator/references/procedures/azure-authentication.md b/plugin/skills/azure-iac-generator/references/procedures/azure-authentication.md
@@ -1,15 +1,11 @@
 # Azure Authentication Check
 
-> **Canonical copy:** Shared authentication gate used by Azure IaC and diagram skills. Keep local copies aligned when this procedure changes.
-
-
-Canonical procedure for verifying Azure session before any Azure operations. Referenced by all skills that interact with Azure.
 
 ---
 
 ## Procedure
 
-1. **Verify session**: Run `az account show` or `Get-AzContext` in the terminal, OR attempt a lightweight Azure MCP call (e.g., `mcp_azure_subscription_list`)
+1. **Verify session**: Run a lightweight Azure MCP call (e.g., `mcp_azure_mcp_subscription_list`), or run `az account show` or `Get-AzContext` in the terminal
 
 2. **If authenticated**:
    - Display the active subscription name and ID
@@ -18,7 +14,7 @@ Canonical procedure for verifying Azure session before any Azure operations. Ref
 3. **If NOT authenticated**:
    - Present this message:
 
-   ```
+   ```markdown
    ## Azure Authentication Required
 
    You need an active Azure session.
@@ -32,4 +28,4 @@ Canonical procedure for verifying Azure session before any Azure operations. Ref
    After authenticating, run this skill again.
    ```
 
-   - **HARD GATE** — Stop execution. Do not proceed without authentication.
+   - **HARD GATE** — Stop execution. Do not proceed without authentication.
diff --git a/plugin/skills/azure-iac-generator/references/procedures/bicep-parsing.md b/plugin/skills/azure-iac-generator/references/procedures/bicep-parsing.md
@@ -1,7 +1,5 @@
 # Bicep Parsing Procedure
 
-> **Canonical copy:** Shared Bicep parsing procedure used by Azure IaC and comparison skills. Keep local copies aligned when this procedure changes.
-
 
 Parse Bicep templates into a structured resource model for comparison. Referenced by skills that analyze existing Bicep files.
 
@@ -15,7 +13,9 @@ Read the `.bicepparam` file and extract all parameter values. These are needed t
 
 ### 2. Read Template Files
 
-Read `main.bicep` and parse all `module` declarations to find referenced Bicep files. Module paths are relative to the file containing the `module` statement — they may reference files outside `modules/` (e.g., `'../shared/networking.bicep'` or `'br:myregistry.azurecr.io/bicep/networking:v1'`). Read each resolved module file recursively to discover nested module references.
+Read `main.bicep` and parse all `module` declarations to find referenced Bicep files. Module paths are relative to the file containing the `module` statement — they may reference files outside `modules/` (e.g., `'../shared/networking.bicep'`). Read each resolved module file recursively to discover nested module references.
+
+> **Registry modules** (`br:` references like `'br:myregistry.azurecr.io/bicep/networking:v1'`) are not local file paths. They require `bicep restore` to download into the local module cache before they can be read. If restoration is not possible, flag these modules as "external — cannot resolve locally" and skip recursive parsing for them.
 
 ### 3. Extract Resources
 
@@ -57,4 +57,4 @@ Output the parsed Bicep resource model in chat for user verification. Schema per
 |---|---|---|
 | Shallow | Type, name, file location | Quick comparison / drift detection |
 | Standard | Above + params, parent refs, conditions | Sync, what-if |
-| Deep | Above + all property values resolved | Policy check, detailed what-if |
+| Deep | Above + all property values resolved | Policy check, detailed what-if |
diff --git a/plugin/skills/azure-iac-generator/references/procedures/diagram-parsing.md b/plugin/skills/azure-iac-generator/references/procedures/diagram-parsing.md
@@ -1,15 +1,14 @@
 # Diagram Parsing Procedure
 
-> **Canonical copy:** Shared diagram-parsing procedure used by Azure IaC and diagram skills. Keep local copies aligned when this procedure changes.
-
-
 Parse a Draw.io XML file into a structured resource model. Referenced by all skills that consume Draw.io diagrams.
 
 ---
 
 ## Procedure
 
-1. **Load the stencil mapping** from [azure-stencil-mapping.json](../azure-stencil-mapping.json) (if available in this skill's references) or derive from the azure2 stencil convention, and build a **reverse lookup**: map each `imagePath` back to its Azure resource type (e.g., `img/lib/azure2/compute/Virtual_Machine.svg` → `Microsoft.Compute/virtualMachines`).
+1. **Load the stencil mapping** from [azure-stencil-mapping.json](../azure-stencil-mapping.json) (if available) or derive from the `azure2` stencil convention, and build **reverse lookups** that map supported Draw.io style identifiers back to Azure resource types:
+   - `image=<path>` → Azure resource type (for `image`-based cells)
+   - `shape=mxgraph.azure2...` → Azure resource type (for `shape`-based cells, using a normalized azure2 shape-key lookup)
 
 2. **Identify resource cells**: For each `mxCell` in the diagram XML:
    - If the style contains `image=<path>` and the path matches the reverse lookup → this is an Azure resource
diff --git a/plugin/skills/azure-iac-generator/references/procedures/resource-filtering.md b/plugin/skills/azure-iac-generator/references/procedures/resource-filtering.md
@@ -1,25 +1,51 @@
 # Resource Filtering for Azure-to-Bicep
 
-> **Canonical copy:** Shared resource-filtering rules used by Azure IaC skills. Keep local copies aligned when this filter list changes.
-
-
 Use this table during Azure-to-Bicep discovery to remove resources that should not become first-class Bicep resources in generated output.
 
 ## Filtering Table
 
 | Resource Pattern or Type | Why It Is Filtered | Exclude for Bicep |
 |---|---|---|
 | `Microsoft.Resources/deployments` | Deployment history is operational metadata, not desired-state infrastructure. | Yes |
-| `Microsoft.Insights/metricalerts` generated by platform onboarding | Often auto-created during monitoring enablement and not part of the requested baseline. | Yes |
-| `Microsoft.AlertsManagement/smartDetectorAlertRules` | Auto-generated smart detection rules are service-managed. | Yes |
-| `microsoft.insights/webtests` created by availability defaults | Synthetic tests may be optional operational assets rather than core infrastructure. | Yes |
+| `Microsoft.Insights/metricAlerts` generated by platform onboarding | Often auto-created during monitoring enablement and not part of the requested baseline. | Yes |  
+| `Microsoft.AlertsManagement/smartDetectorAlertRules` | Auto-generated smart detection rules are service-managed. | Yes |  
+| `Microsoft.Insights/webtests` created by availability defaults | Synthetic tests may be optional operational assets rather than core infrastructure. | Yes |  
 | Resources with `hidden-` prefixes or `hidden-link:` tags | Platform-generated link resources are derived artifacts, not author-managed infrastructure. | Yes |
 | Extension resources whose lifecycle is entirely platform-managed | These resources are recreated by the parent service and should not be emitted directly. | Yes |
 | `Microsoft.Insights/components` | Application Insights is deployable infrastructure and should be preserved. | No |
 | `Microsoft.OperationalInsights/workspaces` | Log Analytics workspaces are deployable infrastructure and should be preserved. | No |
 | `Microsoft.ManagedIdentity/userAssignedIdentities` | User-assigned identities are first-class deployable resources. | No |
 | `Microsoft.Insights/diagnosticSettings` | Diagnostic settings are deployable and often required for parity. | No |
 
+## Exclusion Table
+
+| Resource Type | Exclude for Diagrams | Exclude for Bicep | Rationale |
+|---|---|---|---|
+| `Microsoft.Network/networkWatchers` | ✅ | ✅ | Auto-created by Azure |
+| `Microsoft.Network/networkWatchers/connectionMonitors` | ✅ | ✅ | Auto-created child |
+| `Microsoft.AlertsManagement/smartDetectorAlertRules` | ✅ | ✅ | Auto-created |
+| `Microsoft.Portal/dashboards` | ✅ | ✅ | Portal UI artifact |
+| `Microsoft.Insights/autoscalesettings` (with `hidden-related:` tags) | ✅ | ✅ | Auto-created |
+| `Microsoft.Network/networkIntentPolicies` | ✅ | ✅ | Auto-created |
+| `Microsoft.Network/serviceEndpointPolicies` | ✅ | ✅ | Auto-created |
+| `Microsoft.Resources/deployments` | ✅ | ✅ | Deployment history |
+| `Microsoft.Resources/templateSpecs` | ✅ | ✅ | Template metadata |
+| `Microsoft.Authorization/*` | ✅ | ✅ | RBAC / Policy |
+| `Microsoft.Insights/components` (Application Insights) | ✅ | ❌ KEEP | Deployable; not architecture |
+| `Microsoft.Insights/actionGroups` | ✅ | ❌ KEEP | Deployable; not architecture |
+| `Microsoft.OperationalInsights/workspaces` (Log Analytics) | ✅ | ❌ KEEP | Deployable; not architecture |
+| `Microsoft.ManagedIdentity/userAssignedIdentities` | ❌ KEEP | ❌ KEEP | Explicitly created; used for resource authentication and RBAC |
+| Diagnostic settings (child resources) | ✅ | ❌ KEEP | Deployable as child |
+| Resources with ALL tag keys starting with `hidden-` | ✅ | ✅ | Fully Azure-managed |
+| Resources with `hidden-related:` tag prefixes | ✅ | Check individually | May be Azure-managed |
+
+## Application Rules
+
+1. Check resource type against the table (case-insensitive)
+2. Check if ALL tag keys start with `hidden-` (fully managed)
+3. Apply any user-specified exclusion filters
+4. Remove matching resources from the working list
+
 ## Procedure
 
 1. Start with the full `group_resource_list` output.
diff --git a/plugin/skills/azure-iac-generator/references/version-currency.md b/plugin/skills/azure-iac-generator/references/version-currency.md
@@ -1,6 +1,6 @@
 # Version Currency Rules
 
-> **Canonical copy:** Shared version-selection guidance for Azure IaC skills. Keep local copies aligned when this rule changes.
+version-selection guidance for Azure IaC skills. Keep local copies aligned when this rule changes.
 
 
 All generated code must use current, supported versions. Stale defaults cause security vulnerabilities, missing features, and end-of-life surprises.
diff --git a/tests/skills.json b/tests/skills.json
@@ -30,6 +30,6 @@
     "integrationTestSchedule": {
         "0 5 * * 2-6": "microsoft-foundry",
         "0 8 * * 2-6": "azure-deploy",
-        "0 12 * * 2-6": "airunway-aks-setup,appinsights-instrumentation,azure-ai,azure-aigateway,azure-cloud-migrate,azure-compliance,azure-compute,azure-cost,azure-diagnostics,azure-enterprise-infra-planner,azure-hosted-copilot-sdk,azure-kubernetes,azure-kusto,azure-messaging,azure-prepare,azure-quotas,azure-rbac,azure-resource-lookup,azure-resource-visualizer,azure-storage,azure-upgrade,azure-validate,entra-app-registration"
+        "0 12 * * 2-6": "airunway-aks-setup,appinsights-instrumentation,azure-ai,azure-aigateway,azure-cloud-migrate,azure-compliance,azure-compute,azure-cost,azure-diagnostics,azure-enterprise-infra-planner,azure-hosted-copilot-sdk,azure-iac-generator,azure-kubernetes,azure-kusto,azure-messaging,azure-prepare,azure-quotas,azure-rbac,azure-resource-lookup,azure-resource-visualizer,azure-storage,azure-upgrade,azure-validate,entra-app-registration"
     }
 }

Original file line number	Diff line number	Diff line change
`@@ -1,10 +1,4 @@`
`1`	`1`	`{`
`2`		`- "_canonicalCopy": {`
`3`		`- "description": "Shared Azure stencil mapping copied into azure-iac-generator so diagram-parsing references resolve locally.",`
`4`		`- "maintainers": [`
`5`		`- "Azure IaC skills"`
`6`		`- ]`
`7`		`- },`
`8`	`2`	`"resources": [`
`9`	`3`	`{`
`10`	`4`	`"type": "Microsoft.Compute/virtualMachines",`