fix: Update GPT model version and refactor Docker workflows

.github/workflows/deploy-orchestrator.yml

@@ -72,10 +72,8 @@ env:
 
 jobs:
   docker-build:
+    if: inputs.trigger_type == 'workflow_dispatch' && inputs.build_docker_image == true
     uses: ./.github/workflows/job-docker-build.yml
-    with:
-      trigger_type: ${{ inputs.trigger_type }}
-      build_docker_image: ${{ inputs.build_docker_image }}
     secrets: inherit
 
   deploy:

.github/workflows/job-deploy-linux.yml

@@ -263,7 +263,7 @@ jobs:
           azd env set AZURE_ENV_IMAGE_TAG="$INPUT_IMAGE_TAG"
 
           if [[ "$INPUT_BUILD_DOCKER_IMAGE" == "true" ]]; then
-            ACR_NAME="${{ secrets.ACR_TEST_LOGIN_SERVER }}"
+            ACR_NAME="${{ vars.ACR_TEST_LOGIN_SERVER }}"
             azd env set AZURE_ENV_CONTAINER_REGISTRY_ENDPOINT="$ACR_NAME"
             echo "Set ACR name to: $ACR_NAME"
           else

.github/workflows/job-deploy-windows.yml

@@ -268,7 +268,7 @@ jobs:
 
           # Set ACR name only when building Docker image
           if ("$env:INPUT_BUILD_DOCKER_IMAGE" -eq "true") {
-            $ACR_NAME = "${{ secrets.ACR_TEST_LOGIN_SERVER }}"
+            $ACR_NAME = "${{ vars.ACR_TEST_LOGIN_SERVER }}"
             azd env set AZURE_ENV_CONTAINER_REGISTRY_ENDPOINT="$ACR_NAME"
             Write-Host "Set ACR name to: $ACR_NAME"
           } else {

.github/workflows/job-docker-build.yml

@@ -1,27 +1,21 @@
-name: Docker Build Job
+name: Build & Push Test Images (Feature Branch)
 on:
   workflow_call:
-    inputs:
-      trigger_type:
-        description: 'Trigger type (workflow_dispatch, pull_request, schedule)'
-        required: true
-        type: string
-      build_docker_image:
-        description: 'Build And Push Docker Image (Optional)'
-        required: false
-        default: false
-        type: boolean
     outputs:
       IMAGE_TAG:
         description: "Generated Docker Image Tag"
         value: ${{ jobs.docker-build.outputs.IMAGE_TAG }}
+  workflow_dispatch:
+
+permissions:
+  contents: read
+  id-token: write
 
 env:
   BRANCH_NAME: ${{ github.event.workflow_run.head_branch || github.head_ref || github.ref_name }}
 
 jobs:
   docker-build:
-    if: inputs.trigger_type == 'workflow_dispatch' && inputs.build_docker_image == true
     runs-on: ubuntu-latest
     environment: production
     outputs:
@@ -55,7 +49,11 @@ jobs:
           subscription-id: ${{ secrets.AZURE_SUBSCRIPTION_ID }}
 
       - name: Login to Azure Container Registry
-        run: az acr login --name ${{ secrets.ACR_TEST_LOGIN_SERVER }}
+        shell: bash
+        run: |
+          # Extract registry name from login server (e.g., myacr.azurecr.io -> myacr)
+          ACR_NAME=$(echo "${{ vars.ACR_TEST_LOGIN_SERVER }}" | cut -d'.' -f1)
+          az acr login --name "$ACR_NAME"
 
       - name: Build and Push Cod Mod backend Docker image
         uses: docker/build-push-action@v7
@@ -66,8 +64,8 @@ jobs:
           file: docker/Backend.Dockerfile
           push: true
           tags: |
-            ${{ secrets.ACR_TEST_LOGIN_SERVER }}/cmsabackend:${{ steps.generate_docker_tag.outputs.IMAGE_TAG }}
-            ${{ secrets.ACR_TEST_LOGIN_SERVER }}/cmsabackend:${{ steps.generate_docker_tag.outputs.IMAGE_TAG }}_${{ github.run_number }}
+            ${{ vars.ACR_TEST_LOGIN_SERVER }}/cmsabackend:${{ steps.generate_docker_tag.outputs.IMAGE_TAG }}
+            ${{ vars.ACR_TEST_LOGIN_SERVER }}/cmsabackend:${{ steps.generate_docker_tag.outputs.IMAGE_TAG }}_${{ github.run_number }}
 
       - name: Build and Push Cod Mod frontend Docker image
         uses: docker/build-push-action@v7
@@ -78,8 +76,8 @@ jobs:
           file: docker/Frontend.Dockerfile
           push: true
           tags: |
-            ${{ secrets.ACR_TEST_LOGIN_SERVER }}/cmsafrontend:${{ steps.generate_docker_tag.outputs.IMAGE_TAG }}
-            ${{ secrets.ACR_TEST_LOGIN_SERVER }}/cmsafrontend:${{ steps.generate_docker_tag.outputs.IMAGE_TAG }}_${{ github.run_number }}
+            ${{ vars.ACR_TEST_LOGIN_SERVER }}/cmsafrontend:${{ steps.generate_docker_tag.outputs.IMAGE_TAG }}
+            ${{ vars.ACR_TEST_LOGIN_SERVER }}/cmsafrontend:${{ steps.generate_docker_tag.outputs.IMAGE_TAG }}_${{ github.run_number }}
 
       - name: Verify Docker Image Build
         shell: bash
@@ -91,7 +89,7 @@ jobs:
         if: always()
         shell: bash
         run: |
-          ACR_NAME=$(echo "${{ secrets.ACR_TEST_LOGIN_SERVER }}")
+          ACR_NAME=$(echo "${{ vars.ACR_TEST_LOGIN_SERVER }}")
           echo "## 🐳 Docker Build Job Summary" >> $GITHUB_STEP_SUMMARY
           echo "" >> $GITHUB_STEP_SUMMARY
           echo "| Field | Value |" >> $GITHUB_STEP_SUMMARY

azure.yaml

@@ -15,6 +15,20 @@ parameters:
   baseUrl:
     type: string
     default: 'https://raw.githubusercontent.com/microsoft/Modernize-your-code-solution-accelerator'
+
+hooks:
+  preprovision:
+    windows:
+      run: |
+        Write-Host ""
+        Write-Host "  ---------------------------------------------------------------------------------------------------" -ForegroundColor Yellow
+        Write-Host "  Note: If deployment fails or you encounter an issue, please open an issue with the deployment logs." -ForegroundColor Yellow
+        Write-Host "  https://github.com/microsoft/Modernize-your-code-solution-accelerator/issues" -ForegroundColor Cyan
+        Write-Host "  ---------------------------------------------------------------------------------------------------" -ForegroundColor Yellow
+        Write-Host ""
+      shell: pwsh
+      interactive: true
+
 deployment:
   mode: Incremental
   template: ./infra/main.bicep  # Path to the main.bicep file inside the 'deployment' folder

infra/main.bicep

@@ -777,7 +777,7 @@ module aiServices 'modules/ai-foundry/aifoundry.bicep' = {
       {
         principalId: appIdentity.outputs.principalId
         principalType: 'ServicePrincipal'
-        roleDefinitionIdOrName: 'Cognitive Services OpenAI Contributor'
+        roleDefinitionIdOrName: '5e0bd9bd-7b93-4f28-af87-19fc36ad61bd' // Cognitive Services OpenAI User
       }
       {
         principalId: appIdentity.outputs.principalId
@@ -866,7 +866,7 @@ module storageAccount 'modules/storageAccount.bicep' = {
       {
         principalId: appIdentity.outputs.principalId
         principalType: 'ServicePrincipal'
-        roleDefinitionIdOrName: 'Storage Blob Data Contributor'
+        roleDefinitionIdOrName: 'ba92f5b4-2d11-453d-a403-e96b0029c9fe' // Storage Blob Data Contributor
       }
     ]
     enableTelemetry: enableTelemetry

infra/main.json

@@ -6,7 +6,7 @@
     "_generator": {
       "name": "bicep",
       "version": "0.45.6.27763",
-      "templateHash": "16289228324296064708"
+      "templateHash": "9700625880548826628"
     },
     "name": "Modernize Your Code Solution Accelerator",
     "description": "CSA CTO Gold Standard Solution Accelerator for Modernize Your Code. \r\n"
@@ -13097,11 +13097,11 @@
       },
       "dependsOn": [
         "applicationInsights",
+        "[format('avmPrivateDnsZones[{0}]', variables('dnsZoneIndex').oms)]",
         "[format('avmPrivateDnsZones[{0}]', variables('dnsZoneIndex').agentSvc)]",
         "[format('avmPrivateDnsZones[{0}]', variables('dnsZoneIndex').storageBlob)]",
         "[format('avmPrivateDnsZones[{0}]', variables('dnsZoneIndex').monitor)]",
         "[format('avmPrivateDnsZones[{0}]', variables('dnsZoneIndex').ods)]",
-        "[format('avmPrivateDnsZones[{0}]', variables('dnsZoneIndex').oms)]",
         "dataCollectionEndpoint",
         "logAnalyticsWorkspace",
         "virtualNetwork"
@@ -26157,7 +26157,7 @@
               {
                 "principalId": "[reference('appIdentity').outputs.principalId.value]",
                 "principalType": "ServicePrincipal",
-                "roleDefinitionIdOrName": "Cognitive Services OpenAI Contributor"
+                "roleDefinitionIdOrName": "5e0bd9bd-7b93-4f28-af87-19fc36ad61bd"
               },
               {
                 "principalId": "[reference('appIdentity').outputs.principalId.value]",
@@ -32077,7 +32077,7 @@
               {
                 "principalId": "[reference('appIdentity').outputs.principalId.value]",
                 "principalType": "ServicePrincipal",
-                "roleDefinitionIdOrName": "Storage Blob Data Contributor"
+                "roleDefinitionIdOrName": "ba92f5b4-2d11-453d-a403-e96b0029c9fe"
               }
             ]
           },
@@ -46850,7 +46850,7 @@
             "_generator": {
               "name": "bicep",
               "version": "0.45.6.27763",
-              "templateHash": "4265315615340631916"
+              "templateHash": "15515667313482710688"
             },
             "name": "Container Registry Module",
             "description": "Deploys Azure Container Registry with support for both WAF (private networking) and non-WAF deployments"
@@ -46931,26 +46931,6 @@
                 "[resourceId('Microsoft.ContainerRegistry/registries', parameters('acrName'))]"
               ]
             },
-            {
-              "condition": "[parameters('enableTelemetry')]",
-              "type": "Microsoft.Resources/deployments",
-              "apiVersion": "2025-04-01",
-              "name": "[take(format('46d3xbcp.ptn.acr.{0}.{1}', replace('-..--..-', '.', '-'), substring(uniqueString(deployment().name, parameters('location')), 0, 4)), 64)]",
-              "properties": {
-                "mode": "Incremental",
-                "template": {
-                  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
-                  "contentVersion": "1.0.0.0",
-                  "resources": [],
-                  "outputs": {
-                    "telemetry": {
-                      "type": "String",
-                      "value": "For more information, see https://aka.ms/avm/TelemetryInfo"
-                    }
-                  }
-                }
-              }
-            },
             {
               "condition": "[and(parameters('enablePrivateNetworking'), not(empty(parameters('privateDnsZoneResourceId'))))]",
               "type": "Microsoft.Resources/deployments",

infra/main_custom.bicep

@@ -687,7 +687,7 @@ module aiServices 'modules/ai-foundry/aifoundry.bicep' = {
       {
         principalId: appIdentity.outputs.principalId
         principalType: 'ServicePrincipal'
-        roleDefinitionIdOrName: 'Cognitive Services OpenAI Contributor'
+        roleDefinitionIdOrName: '5e0bd9bd-7b93-4f28-af87-19fc36ad61bd' // Cognitive Services OpenAI User
       }
       {
         principalId: appIdentity.outputs.principalId
@@ -776,7 +776,7 @@ module storageAccount 'modules/storageAccount.bicep' = {
       {
         principalId: appIdentity.outputs.principalId
         principalType: 'ServicePrincipal'
-        roleDefinitionIdOrName: 'Storage Blob Data Contributor'
+        roleDefinitionIdOrName: 'ba92f5b4-2d11-453d-a403-e96b0029c9fe' // Storage Blob Data Contributor
       }
     ]
     enableTelemetry: enableTelemetry

src/backend/common/telemetry/patch_instrumentor.py

@@ -30,6 +30,54 @@ def _fixed_response_to_str(response_format: Any) -> Optional[str]:
         return str(response_format)
 
 
+def _patch_fastapi_route_details():
+    """
+    Patch opentelemetry-instrumentation-fastapi's _get_route_details.
+
+    The bug: _get_route_details() iterates over app.routes and reads
+    `starlette_route.path`. With FastAPI >= 0.119.0, app.include_router()
+    leaves an `_IncludedRouter` object in app.routes that has no `.path`
+    attribute. This raises:
+        AttributeError: '_IncludedRouter' object has no attribute 'path'
+
+    It is triggered on requests where no concrete route matches FULL,
+    most notably CORS preflight `OPTIONS` requests from the frontend,
+    causing a 500 on the preflight and blocking the real request.
+
+    The fix: replace the module-level _get_route_details with a version
+    that uses getattr(..., "path", None) and ignores routes whose
+    matches() raises. _get_default_span_details references this function
+    as a module global, so patching the module attribute is sufficient.
+    """
+    try:
+        import opentelemetry.instrumentation.fastapi as fastapi_instr
+        from starlette.routing import Match
+    except ImportError:
+        logger.debug("opentelemetry.instrumentation.fastapi not installed, skipping patch")
+        return
+
+    try:
+        def _safe_get_route_details(scope: Any) -> Optional[str]:
+            app = scope["app"]
+            route = None
+            for starlette_route in app.routes:
+                try:
+                    match, _ = starlette_route.matches(scope)
+                except Exception:  # noqa: BLE001
+                    continue
+                if match == Match.FULL:
+                    route = getattr(starlette_route, "path", None)
+                    break
+                if match == Match.PARTIAL:
+                    route = getattr(starlette_route, "path", None)
+            return route
+
+        fastapi_instr._get_route_details = _safe_get_route_details
+        logger.info("Patched opentelemetry.instrumentation.fastapi._get_route_details")
+    except Exception:  # noqa: BLE001
+        logger.exception("Failed to patch opentelemetry.instrumentation.fastapi route details")
+
+
 def patch_instrumentors():
     """
     Patch Azure AI telemetry instrumentors to handle dict response_format.
@@ -60,3 +108,8 @@ def patch_instrumentors():
         logger.info("Patched azure.ai.projects instrumentor")
     except ImportError:
         logger.debug("azure.ai.projects telemetry not installed, skipping patch")
+
+    # Patch opentelemetry-instrumentation-fastapi to tolerate routes without a
+    # `.path` attribute (e.g. FastAPI >= 0.119.0 `_IncludedRouter`), which
+    # otherwise crashes span-name resolution on CORS preflight OPTIONS requests.
+    _patch_fastapi_route_details()