roll back commands fix

Author: Rafi-Microsoft

infra/scripts/deploy_to_azure.ps1

@@ -668,18 +668,37 @@ function Print-Summary {
 
     Write-Host ""
     Write-Host "  ┌─ Rollback Commands (if needed) ───────────────────────────────"
+    Write-Host "  │  NOTE: When rolling back to images from a different registry"
+    Write-Host "  │  (e.g. biabcontainerreg.azurecr.io public defaults), the Web App"
+    Write-Host "  │  also needs acrUseManagedIdentityCreds disabled and the"
+    Write-Host "  │  DOCKER_REGISTRY_SERVER_URL updated, otherwise the pull will"
+    Write-Host "  │  fail with ACRTokenRetrievalFailure. Container Apps fall back"
+    Write-Host "  │  to anonymous pull automatically for public registries."
+    Write-Host "  └──────────────────────────────────────────────────────────────"
+    Write-Host ""
+    Write-Host "  Copy/paste the commands below (one per line):"
+    Write-Host ""
 
     if ($script:DeployBackend -and $script:BackendCA -and $script:OldBackendImage) {
-        Write-Host "  │  Backend:  az containerapp update --name $($script:BackendCA) --resource-group $ResourceGroup --image $($script:OldBackendImage)"
+        Write-Host "  # Backend rollback"
+        Write-Host "  az containerapp update --name $($script:BackendCA) --resource-group $ResourceGroup --image $($script:OldBackendImage)"
+        Write-Host ""
     }
     if ($script:DeployMcp -and $script:McpCA -and $script:OldMcpImage) {
-        Write-Host "  │  MCP:      az containerapp update --name $($script:McpCA) --resource-group $ResourceGroup --image $($script:OldMcpImage)"
+        Write-Host "  # MCP rollback"
+        Write-Host "  az containerapp update --name $($script:McpCA) --resource-group $ResourceGroup --image $($script:OldMcpImage)"
+        Write-Host ""
     }
     if ($script:DeployFrontend -and $script:FrontendApp -and $script:OldFrontendImage) {
         $oldImg = $script:OldFrontendImage -replace '^DOCKER\|', ''
-        Write-Host "  │  Frontend: az webapp config container set --name $($script:FrontendApp) --resource-group $ResourceGroup --container-image-name $oldImg"
+        $oldRegistry = ($oldImg -split '/')[0]
+        Write-Host "  # Frontend rollback (run all 4 lines)"
+        Write-Host "  az webapp config set --name $($script:FrontendApp) --resource-group $ResourceGroup --generic-configurations '{\""acrUseManagedIdentityCreds\"": false}'"
+        Write-Host "  az webapp config appsettings set --name $($script:FrontendApp) --resource-group $ResourceGroup --settings DOCKER_REGISTRY_SERVER_URL=https://$oldRegistry"
+        Write-Host "  az webapp config container set --name $($script:FrontendApp) --resource-group $ResourceGroup --container-image-name $oldImg"
+        Write-Host "  az webapp restart --name $($script:FrontendApp) --resource-group $ResourceGroup"
+        Write-Host ""
     }
-    Write-Host "  └──────────────────────────────────────────────────────────────"
 
     if ($DryRun) {
         Write-Host ""

infra/scripts/deploy_to_azure.sh

@@ -822,18 +822,37 @@ print_summary() {
 
     echo ""
     echo "  ┌─ Rollback Commands (if needed) ───────────────────────────────"
+    echo "  │  NOTE: When rolling back to images from a different registry"
+    echo "  │  (e.g. biabcontainerreg.azurecr.io public defaults), the Web App"
+    echo "  │  also needs acrUseManagedIdentityCreds disabled and the"
+    echo "  │  DOCKER_REGISTRY_SERVER_URL updated, otherwise the pull will"
+    echo "  │  fail with ACRTokenRetrievalFailure. Container Apps fall back"
+    echo "  │  to anonymous pull automatically for public registries."
+    echo "  └──────────────────────────────────────────────────────────────"
+    echo ""
+    echo "  Copy/paste the commands below (one per line):"
+    echo ""
 
     if [[ "$DEPLOY_BACKEND" == true && -n "$BACKEND_CA" && -n "${OLD_BACKEND_IMAGE:-}" ]]; then
-        echo "  │  Backend:  az containerapp update --name $BACKEND_CA --resource-group $RESOURCE_GROUP --image $OLD_BACKEND_IMAGE"
+        echo "  # Backend rollback"
+        echo "  az containerapp update --name $BACKEND_CA --resource-group $RESOURCE_GROUP --image $OLD_BACKEND_IMAGE"
+        echo ""
     fi
     if [[ "$DEPLOY_MCP" == true && -n "$MCP_CA" && -n "${OLD_MCP_IMAGE:-}" ]]; then
-        echo "  │  MCP:      az containerapp update --name $MCP_CA --resource-group $RESOURCE_GROUP --image $OLD_MCP_IMAGE"
+        echo "  # MCP rollback"
+        echo "  az containerapp update --name $MCP_CA --resource-group $RESOURCE_GROUP --image $OLD_MCP_IMAGE"
+        echo ""
     fi
     if [[ "$DEPLOY_FRONTEND" == true && -n "$FRONTEND_APP" && -n "${OLD_FRONTEND_IMAGE:-}" ]]; then
         local old_img="${OLD_FRONTEND_IMAGE#DOCKER|}"
-        echo "  │  Frontend: az webapp config container set --name $FRONTEND_APP --resource-group $RESOURCE_GROUP --container-image-name $old_img"
+        local old_registry="${old_img%%/*}"
+        echo "  # Frontend rollback (run all 4 lines)"
+        echo "  az webapp config set --name $FRONTEND_APP --resource-group $RESOURCE_GROUP --generic-configurations '{\"acrUseManagedIdentityCreds\": false}'"
+        echo "  az webapp config appsettings set --name $FRONTEND_APP --resource-group $RESOURCE_GROUP --settings DOCKER_REGISTRY_SERVER_URL=https://$old_registry"
+        echo "  az webapp config container set --name $FRONTEND_APP --resource-group $RESOURCE_GROUP --container-image-name $old_img"
+        echo "  az webapp restart --name $FRONTEND_APP --resource-group $RESOURCE_GROUP"
+        echo ""
     fi
-    echo "  └──────────────────────────────────────────────────────────────"
 
     if [[ "$DRY_RUN" == true ]]; then
         echo ""