Merge branch 'dev' into sfi-fix

Author: Kanchan-Microsoft

.github/workflows/validate-bicep-params.yml

@@ -35,9 +35,9 @@ jobs:
         continue-on-error: true
         env:
           ACCELERATOR_NAME: ${{ env.accelerator_name }}
+          RUN_URL: ${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}
         run: |
           set +e
-          RUN_URL="https://github.com/${GITHUB_REPOSITORY}/actions/runs/${GITHUB_RUN_ID}"
           python infra/scripts/validate_bicep_params.py --dir infra --strict --no-color \
             --json-output infra_results.json \
             --html-output email_body.html \

docs/images/readme/approach.png

@@ -1241,7 +1241,6 @@ module avmCosmosDB 'br/public:avm/res/document-db/database-account:0.19.0' = {
     capabilitiesToAdd: [
       'EnableMongo'
     ]
-    enableAnalyticalStorage: true
     defaultConsistencyLevel: 'Session'
     maxIntervalInSeconds: 5
     maxStalenessPrefix: 100

docs/images/readme/processing-pipeline.png

@@ -6,7 +6,7 @@
     "_generator": {
       "name": "bicep",
       "version": "0.42.1.51946",
-      "templateHash": "12538110573757351724"
+      "templateHash": "12078312041649297460"
     },
     "name": "Content Processing Solution Accelerator",
     "description": "Bicep template to deploy the Content Processing Solution Accelerator with AVM compliance."
@@ -42485,9 +42485,9 @@
       },
       "dependsOn": [
         "avmAiServices",
-        "[format('avmPrivateDnsZones[{0}]', variables('dnsZoneIndex').aiServices)]",
         "[format('avmPrivateDnsZones[{0}]', variables('dnsZoneIndex').contentUnderstanding)]",
         "[format('avmPrivateDnsZones[{0}]', variables('dnsZoneIndex').cognitiveServices)]",
+        "[format('avmPrivateDnsZones[{0}]', variables('dnsZoneIndex').aiServices)]",
         "[format('avmPrivateDnsZones[{0}]', variables('dnsZoneIndex').openAI)]",
         "virtualNetwork"
       ]
@@ -50797,9 +50797,6 @@
               "EnableMongo"
             ]
           },
-          "enableAnalyticalStorage": {
-            "value": true
-          },
           "defaultConsistencyLevel": {
             "value": "Session"
           },

docs/images/readme/solution-architecture.png

@@ -29,6 +29,7 @@
 from __future__ import annotations
 
 import argparse
+import html
 import json
 import re
 import sys
@@ -346,13 +347,14 @@ def print_report(results: list[ValidationResult], *, use_color: bool = True) ->
 # ---------------------------------------------------------------------------
 
 def _html_escape(text: str) -> str:
-    """Escape HTML special characters."""
-    return (
-        text.replace("&", "&")
-        .replace("<", "&lt;")
-        .replace(">", "&gt;")
-        .replace('"', "&quot;")
-    )
+    """Escape HTML special characters (including quotes) for safe use in
+    both element content and attribute values.
+
+    Thin wrapper around :func:`html.escape` so we can keep a single, stable
+    call-site in this module while delegating the actual escaping rules to
+    the stdlib.
+    """
+    return html.escape(text, quote=True)
 
 
 def generate_html_report(

infra/main.bicep

@@ -12,6 +12,7 @@
 import logging
 import time
 from pathlib import Path
+from typing import Optional
 
 import requests
 from requests.models import Response
@@ -294,20 +295,32 @@ def begin_analyze(self, analyzer_id: str, file_location: str):
 
     def get_image_from_analyze_operation(
         self, analyze_response: Response, image_id: str
-    ):
-        """Retrieves a generated file (e.g., a rendered page image) from a
-        completed analyze operation by its file id / path.
-
-        In Content Understanding GA the file-retrieval URL changed from
-        ``{operationLocation}/images/{imageId}`` to
-        ``{operationLocation}/files/{fileId}`` (where ``operationLocation`` now
-        ends in ``/analyzerResults/{operationId}``).
+    ) -> Optional[bytes]:
+        """Retrieve a rendered page image (JPEG) generated by a completed
+        analyze operation, by its file id / path.
+
+        Although the GA file-retrieval endpoint is generic
+        (``{operationLocation}/files/{fileId}``, replacing the legacy
+        ``{operationLocation}/images/{imageId}``), this helper is intentionally
+        image-specific: it asserts that the returned ``Content-Type`` is
+        ``image/jpeg`` and is only intended for use with JPEG page images
+        produced by the analyzer. Use a different helper if you need to fetch
+        non-image generated files.
 
         Args:
-            analyze_response (Response): The response object from the analyze operation.
-            image_id (str): The id (or path) of the file to retrieve.
+            analyze_response (Response): The response object from the analyze
+                operation (used only to read its ``operation-location`` header).
+            image_id (str): The id (or path) of the image file to retrieve.
+
         Returns:
-            bytes: The file content as a byte string.
+            Optional[bytes]: The JPEG image bytes on success, or ``None`` if
+            the HTTP request fails (the underlying :class:`RequestException`
+            is logged but not re-raised).
+
+        Raises:
+            ValueError: If the analyze response does not contain an
+                ``operation-location`` header.
+            AssertionError: If the retrieved file is not ``image/jpeg``.
         """
         operation_location = analyze_response.headers.get("operation-location", "")
         if not operation_location:
@@ -326,7 +339,7 @@ def get_image_from_analyze_operation(
 
             return response.content
         except requests.exceptions.RequestException as e:
-            print(f"HTTP request failed: {e}")
+            self._logger.error("HTTP request failed while retrieving image: %s", e)
             return None
 
     def poll_result(