Merge pull request #467 from microsoft/psl-remotpushimage-codmod

feat: Refactor infrastructure parameters and add image build scripts

Author: Roopan-Microsoft

docs/CustomizingAzdParameters.md

@@ -12,17 +12,16 @@ By default this template will use the environment name as the prefix to prevent
 | `AZURE_LOCATION`                       | string  | `<User selects during deployment>`      | Location of the Azure resources. Controls where the infrastructure will be deployed.                 |
 | `AZURE_ENV_AI_SERVICE_LOCATION`        | string  | `<User selects during deployment>`     | Location of the Azure resources. Controls where the Azure AI Services will be deployed. |
 | `AZURE_ENV_MODEL_DEPLOYMENT_TYPE`      | string  | `GlobalStandard` | Change the Model Deployment Type (allowed values: Standard, GlobalStandard).                         |
-| `AZURE_ENV_GPT_MODEL_NAME`             | string  | `gpt-4o`         | Set the Model Name (allowed values: gpt-4o).                                                         |
-| `AZURE_ENV_GPT_MODEL_VERSION`          | string  | `2024-08-06`     | Set the Azure model version (allowed values: 2024-08-06)    |
+| `AZURE_ENV_GPT_MODEL_NAME`             | string  | `gpt-5.1`         | Set the Model Name (allowed values: gpt-5.1).                                                         |
+| `AZURE_ENV_GPT_MODEL_VERSION`          | string  | `2025-11-13`     | Set the Azure model version (allowed values: 2025-11-13)    |
 | `AZURE_ENV_GPT_MODEL_CAPACITY`         | integer | `150`            | Set the Model Capacity (choose a number based on available GPT model capacity in your subscription). |
-| `AZURE_ENV_EXISTING_LOG_ANALYTICS_WORKSPACE_RID`| string  | Guide to get your [Existing Workspace ID](/docs/re-use-log-analytics.md)     | Set this if you want to reuse an existing Log Analytics Workspace instead of creating a new one.     |
-| `AZURE_ENV_IMAGE_TAG`                  | string  | `latest`         | Set the Image tag Like (allowed values: latest, dev, hotfix)    |
+| `AZURE_ENV_EXISTING_LOG_ANALYTICS_WORKSPACE_RID`| string  | Guide to get your [Existing Workspace ID](re-use-log-analytics.md)     | Set this if you want to reuse an existing Log Analytics Workspace instead of creating a new one.     |
+| `AZURE_ENV_IMAGE_TAG`                  | string  | `latest`         | Tag applied to the backend/frontend images that are built remotely and pushed to the deployment's Azure Container Registry.    |
 | `AZURE_ENV_VM_SIZE`                    | string  | `Standard_D2s_v5`         | Specifies the size of the Jumpbox Virtual Machine (e.g., `Standard_D2s_v5`, `Standard_D2s_v4`). Set a custom value if `enablePrivateNetworking` is `true`.    |
 | `AZURE_ENV_JUMPBOX_ADMIN_USERNAME`     | string  | `JumpboxAdminUser`          | Specifies the administrator username for the Jumpbox Virtual Machine.      |
 | `AZURE_ENV_JUMPBOX_ADMIN_PASSWORD`     | string  | `JumpboxAdminP@ssw0rd1234!` | Specifies the administrator password for the Jumpbox Virtual Machine.      |
 | `AZURE_ENV_COSMOS_SECONDARY_LOCATION`  | string  | *(not set by default)*      | Specifies the secondary region for Cosmos DB. Required if `enableRedundancy` is `true`. |
 | `AZURE_EXISTING_AIPROJECT_RESOURCE_ID` | string  | *(not set by default)*      | Specifies the existing AI Foundry Project Resource ID if it needs to be reused. |
-| `AZURE_ENV_CONTAINER_REGISTRY_ENDPOINT`| string  | *(not set by default)*      | Specifies the Azure Container Registry endpoint to use for container images. |
 
 ---
 

docs/DeploymentGuide.md

@@ -280,42 +280,59 @@ azd config set provision.preflight off
 azd up
 ```
 
+## Step 5: Build and Push Container Images
+### 5.1 Run Image Build Script
+ 
+1. You can run the ACR build and push script from the project root. Use the appropriate command for your shell:
+ 
+   - For Bash (Linux/macOS/WSL):
+ 
+     ```bash
+     bash scripts/build_and_push_images.sh
+     ```
+ 
+   - For PowerShell (Windows):
+ 
+     ```
+     .\scripts\build_and_push_images.ps1
+     ```
+
 **During deployment, you'll be prompted for:**
 1. **Environment name** (e.g., "cmsaapp") - Must be 3-16 characters long, alphanumeric only
 2. **Azure subscription** selection
 3. **Azure region** - Select a region with available GPT model quota
 4. **Resource group** selection (create new or use existing)
 
-**Expected Duration:** 6-9 minutes for default configuration
+**Expected Duration:** 9-14 minutes for default configuration (includes remotely building and pushing the container images)
 
 **⚠️ Deployment Issues:** If you encounter errors or timeouts, try a different region as there may be capacity constraints. For detailed error solutions, see our [Troubleshooting Guide](./TroubleShootingSteps.md).
 
-### 4.3 Get Application URL
+### 5.2 Get Application URL
 
 After successful deployment:
 1. Open [Azure Portal](https://portal.azure.com/)
 2. Navigate to your resource group
 3. Find the Container App with "frontend" in the name
 4. Copy the **Application URI**
 
-⚠️ **Important:** Complete [Post-Deployment Steps](#step-5-post-deployment-configuration) before accessing the application.
+⚠️ **Important:** Complete Step 5.1 and Step 6.1 before accessing the application.
 
-## Step 5: Post-Deployment Configuration
+## Step 6: Post-Deployment Configuration
 
-### 5.1 Configure Authentication (Required)
+### 6.1 Configure Authentication (Required)
 
 **This step is mandatory for application access:**
 
 1. Follow [App Authentication Configuration](./AddAuthentication.md)
 2. Wait up to 10 minutes for authentication changes to take effect
 
-### 5.2 Verify Deployment
+### 6.2 Verify Deployment
 
-1. Access your application using the URL from Step 4.3
+1. Access your application using the URL from Step 5.2
 2. Confirm the application loads successfully
 3. Verify you can sign in with your authenticated account
 
-### 5.3 Test the Application
+### 6.3 Test the Application
 
 Follow the detailed workflow to test the migration functionality:
 
@@ -329,7 +346,7 @@ Follow the detailed workflow to test the migration functionality:
 
 📖 **Detailed Instructions:** See the complete [Sample Workflow](./SampleWorkflow.md) guide for step-by-step testing procedures.
 
-## Step 6: Clean Up (Optional)
+## Step 7: Clean Up (Optional)
 
 ### Remove All Resources
 ```shell

infra/main.bicep

@@ -34,7 +34,7 @@ param location string = resourceGroup().location
   azd : {
     type: 'location'
     usageName : [
-      'OpenAI.GlobalStandard.gpt-4o, 150'
+      'OpenAI.GlobalStandard.gpt-5.1, 150'
     ]
   }
 })
@@ -98,19 +98,16 @@ param enableTelemetry bool = true
 param deploymentType string = 'GlobalStandard'
 
 @minLength(1)
-@description('Optional. Name of the GPT model to deploy. Defaults to gpt-4o.')
-param gptModelName string = 'gpt-4o'
+@description('Optional. Name of the GPT model to deploy. Defaults to gpt-5.1.')
+param gptModelName string = 'gpt-5.1'
 
 @minLength(1)
-@description('Optional. Set the Image tag. Defaults to latest_2025-11-10_599.')
-param imageTag string = 'latest_2025-11-10_599'
-
-@description('Optional. Azure Container Registry endpoint. Defaults to cmsacontainerreg.azurecr.io')
-param containerRegistryEndpoint string = 'cmsacontainerreg.azurecr.io'
+@description('Optional. Image tag applied to the backend/frontend images that are built remotely and pushed to the deployment\'s Azure Container Registry by the post-provision script. Defaults to latest.')
+param imageTag string = 'latest'
 
 @minLength(1)
-@description('Optional. Version of the GPT model to deploy. Defaults to 2024-08-06.')
-param gptModelVersion string = '2024-08-06'
+@description('Optional. Version of the GPT model to deploy. Defaults to 2025-11-13.')
+param gptModelVersion string = '2025-11-13'
 
 @description('Optional. Use this parameter to use an existing AI project resource ID. Defaults to empty string.')
 param existingFoundryProjectResourceId string = ''
@@ -897,6 +894,35 @@ module cosmosDb 'modules/cosmosDb.bicep' = {
   }
 }
 
+// ========== Azure Container Registry ========== //
+// A dedicated Azure Container Registry is provisioned with every deployment.
+// The container apps are initially created with a public "hello world" placeholder
+// image; the post-provision script (scripts/build_and_push_images.*) builds the
+// backend/frontend images remotely with 'az acr build', pushes them to this registry,
+// and then updates the container apps to run the freshly built images.
+var placeholderContainerImage = 'mcr.microsoft.com/azuredocs/containerapps-helloworld:latest'
+
+module containerRegistry 'br/public:avm/res/container-registry/registry:0.12.1' = {
+  name: take('avm.res.container-registry.registry.${solutionSuffix}', 64)
+  params: {
+    #disable-next-line BCP334 // solutionSuffix always yields a name of sufficient length at deployment time
+    name: take('cr${solutionSuffix}', 50)
+    location: location
+    acrSku: enableRedundancy ? 'Premium' : 'Standard'
+    acrAdminUserEnabled: false
+    zoneRedundancy: enableRedundancy ? 'Enabled' : 'Disabled'
+    roleAssignments: [
+      {
+        principalId: appIdentity.outputs.principalId
+        principalType: 'ServicePrincipal'
+        roleDefinitionIdOrName: 'AcrPull'
+      }
+    ]
+    tags: allTags
+    enableTelemetry: enableTelemetry
+  }
+}
+
 var containerAppsEnvironmentName = 'cae-${solutionSuffix}'
 
 module containerAppsEnvironment 'br/public:avm/res/app/managed-environment:0.13.1' = {
@@ -953,10 +979,17 @@ module containerAppBackend 'br/public:avm/res/app/container-app:0.22.0' = {
         appIdentity.outputs.resourceId
       ]
     }
+    registries: [
+      {
+        server: containerRegistry.outputs.loginServer
+        identity: appIdentity.outputs.resourceId
+      }
+    ]
     containers: [
       {
         name: 'cmsabackend'
-        image: '${containerRegistryEndpoint}/cmsabackend:${imageTag}'
+        // Placeholder image; replaced with the ACR image by scripts/build_and_push_images.*
+        image: placeholderContainerImage
         env: concat(
           [
             {
@@ -1133,6 +1166,12 @@ module containerAppFrontend 'br/public:avm/res/app/container-app:0.22.0' = {
         appIdentity.outputs.resourceId
       ]
     }
+    registries: [
+      {
+        server: containerRegistry.outputs.loginServer
+        identity: appIdentity.outputs.resourceId
+      }
+    ]
     containers: [
       {
         env: [
@@ -1145,7 +1184,8 @@ module containerAppFrontend 'br/public:avm/res/app/container-app:0.22.0' = {
             value: 'prod'
           }
         ]
-        image: '${containerRegistryEndpoint}/cmsafrontend:${imageTag}'
+        // Placeholder image; replaced with the ACR image by scripts/build_and_push_images.*
+        image: placeholderContainerImage
         name: 'cmsafrontend'
         resources: {
           cpu: 1
@@ -1202,3 +1242,18 @@ output PICKER_AGENT_MODEL_DEPLOY string = modelDeployment.name
 output FIXER_AGENT_MODEL_DEPLOY string = modelDeployment.name
 output SEMANTIC_VERIFIER_AGENT_MODEL_DEPLOY string = modelDeployment.name
 output SYNTAX_CHECKER_AGENT_MODEL_DEPLOY string = modelDeployment.name  
+
+// ========== Container Registry / image build outputs ========== //
+// Consumed by the post-provision script (scripts/build_and_push_images.*) to build
+// and push the application images and update the container apps.
+@description('Login server of the Azure Container Registry provisioned for this deployment.')
+output AZURE_CONTAINER_REGISTRY_ENDPOINT string = containerRegistry.outputs.loginServer
+@description('Name of the Azure Container Registry provisioned for this deployment.')
+output AZURE_CONTAINER_REGISTRY_NAME string = containerRegistry.outputs.name
+@description('Image tag used when building and pushing the backend/frontend images.')
+output AZURE_ENV_IMAGE_TAG string = imageTag
+@description('Name of the backend container app to update with the freshly built image.')
+output BACKEND_CONTAINER_APP_NAME string = containerAppBackend.outputs.name
+@description('Name of the frontend container app to update with the freshly built image.')
+output FRONTEND_CONTAINER_APP_NAME string = containerAppFrontend.outputs.name
+