Gap-2: Container Apps Develop (C → A) — Templates + Dapr + Jobs + Functions-on-ACA

[paulyuk]

Closes #1610 | Parent: #1608

15 template files: selection tree, 6 base templates (web-app, api, microservice, worker, job, functions-on-aca), 6 recipes (Dapr, Cosmos, Service Bus, Redis, ACR, PostgreSQL), composition algorithm.

Key: Container Apps is a general-purpose serverless container platform for any stack. Event-driven = Functions on Container Apps.

Starting assessment — domain experts should review.

[Copilot]

Pull request overview

Adds “reference only” documentation for Azure Container Apps base templates and composable integration recipes, plus a documented composition algorithm and selection decision tree to guide template/recipe choice.

Changes:

• Added base template docs for common Container Apps workloads (web app, API, worker, job, microservices, Functions on ACA)
• Added integration recipe docs (Dapr, Cosmos DB, Service Bus, Redis, ACR, PostgreSQL) with Bicep snippets, env vars, RBAC guidance, and scaling patterns
• Added a workload selection decision tree and a step-by-step composition/merge algorithm

Reviewed changes

Copilot reviewed 15 out of 15 changed files in this pull request and generated 12 comments.

Show a summary per file

File	Description
plugin/skills/azure-prepare/references/services/container-apps/templates/worker.md	New worker template doc with Bicep example and KEDA scaling patterns
plugin/skills/azure-prepare/references/services/container-apps/templates/web-app.md	New web app template doc with ingress, scaling, and health probe examples
plugin/skills/azure-prepare/references/services/container-apps/templates/selection.md	New decision tree for selecting base templates and recipes
plugin/skills/azure-prepare/references/services/container-apps/templates/recipes/servicebus/README.md	New Service Bus recipe doc (Bicep + RBAC + KEDA rule + SDK example)
plugin/skills/azure-prepare/references/services/container-apps/templates/recipes/redis/README.md	New Redis recipe doc (Bicep + RBAC + SDK example + Dapr component snippet)
plugin/skills/azure-prepare/references/services/container-apps/templates/recipes/postgres/README.md	New PostgreSQL recipe doc (Bicep + Entra auth examples + firewall snippet)
plugin/skills/azure-prepare/references/services/container-apps/templates/recipes/dapr/README.md	New Dapr recipe doc (enablement + components examples)
plugin/skills/azure-prepare/references/services/container-apps/templates/recipes/cosmos/README.md	New Cosmos DB recipe doc (Bicep + RBAC + SDK example)
plugin/skills/azure-prepare/references/services/container-apps/templates/recipes/composition.md	New authoritative composition algorithm doc
plugin/skills/azure-prepare/references/services/container-apps/templates/recipes/acr/README.md	New ACR recipe doc (Bicep + RBAC + build workflow)
plugin/skills/azure-prepare/references/services/container-apps/templates/recipes/README.md	New recipes index/overview doc
plugin/skills/azure-prepare/references/services/container-apps/templates/microservice.md	New microservices template doc with service discovery guidance
plugin/skills/azure-prepare/references/services/container-apps/templates/job.md	New jobs template doc (scheduled/event/manual) with Bicep examples
plugin/skills/azure-prepare/references/services/container-apps/templates/functions-on-aca.md	New Functions-on-ACA template doc with Dockerfile/Bicep guidance
plugin/skills/azure-prepare/references/services/container-apps/templates/api.md	New API template doc with gRPC toggle and CORS example

[github-actions]

Details

# 🔍 Token Analysis Report

@github-copilot-for-azure/scripts@1.0.0 tokens
node --import tsx src/tokens/cli.ts compare --base origin/main --head HEAD --markdown

fatal: path 'plugin/skills/azure-prepare/references/services/container-apps/templates/api.md' exists on disk, but not in 'origin/main'
fatal: path 'plugin/skills/azure-prepare/references/services/container-apps/templates/functions-on-aca.md' exists on disk, but not in 'origin/main'
fatal: path 'plugin/skills/azure-prepare/references/services/container-apps/templates/job.md' exists on disk, but not in 'origin/main'
fatal: path 'plugin/skills/azure-prepare/references/services/container-apps/templates/microservice.md' exists on disk, but not in 'origin/main'
fatal: path 'plugin/skills/azure-prepare/references/services/container-apps/templates/recipes/README.md' exists on disk, but not in 'origin/main'
fatal: path 'plugin/skills/azure-prepare/references/services/container-apps/templates/recipes/acr/README.md' exists on disk, but not in 'origin/main'
fatal: path 'plugin/skills/azure-prepare/references/services/container-apps/templates/recipes/composition.md' exists on disk, but not in 'origin/main'
fatal: path 'plugin/skills/azure-prepare/references/services/container-apps/templates/recipes/cosmos/README.md' exists on disk, but not in 'origin/main'
fatal: path 'plugin/skills/azure-prepare/references/services/container-apps/templates/recipes/dapr/README.md' exists on disk, but not in 'origin/main'
fatal: path 'plugin/skills/azure-prepare/references/services/container-apps/templates/recipes/postgres/README.md' exists on disk, but not in 'origin/main'
fatal: path 'plugin/skills/azure-prepare/references/services/container-apps/templates/recipes/redis/README.md' exists on disk, but not in 'origin/main'
fatal: path 'plugin/skills/azure-prepare/references/services/container-apps/templates/recipes/servicebus/README.md' exists on disk, but not in 'origin/main'
fatal: path 'plugin/skills/azure-prepare/references/services/container-apps/templates/selection.md' exists on disk, but not in 'origin/main'
fatal: path 'plugin/skills/azure-prepare/references/services/container-apps/templates/web-app.md' exists on disk, but not in 'origin/main'
fatal: path 'plugin/skills/azure-prepare/references/services/container-apps/templates/worker.md' exists on disk, but not in 'origin/main'

📊 Token Change Report

Comparing origin/main → HEAD

Summary

Metric	Value
📈 Total Change	+13,247 tokens (+375%)
Before	3,533 tokens
After	16,780 tokens
Files Changed	18

Changed Files

File	Before	After	Change
plugin/skills/azure-prepare/references/services/container-apps/templates/functions-on-aca.md	-	1,133	+1133
plugin/skills/azure-prepare/references/services/container-apps/templates/selection.md	-	1,128	+1128
plugin/skills/azure-prepare/references/services/container-apps/templates/recipes/composition.md	-	1,105	+1105
plugin/skills/azure-prepare/references/services/container-apps/templates/job.md	-	1,062	+1062
plugin/skills/azure-prepare/references/services/container-apps/templates/worker.md	-	1,025	+1025
plugin/skills/azure-prepare/references/services/container-apps/templates/api.md	-	871	+871
plugin/skills/azure-prepare/references/services/container-apps/templates/recipes/postgres/README.md	-	869	+869
plugin/skills/azure-prepare/references/services/container-apps/templates/web-app.md	-	812	+812
plugin/skills/azure-prepare/references/services/container-apps/templates/recipes/redis/README.md	-	804	+804
plugin/skills/azure-prepare/references/services/container-apps/templates/microservice.md	-	799	+799
plugin/skills/azure-prepare/references/services/container-apps/templates/recipes/servicebus/README.md	-	756	+756
plugin/skills/azure-prepare/references/services/container-apps/templates/recipes/acr/README.md	-	710	+710
plugin/skills/azure-prepare/references/services/container-apps/templates/recipes/dapr/README.md	-	681	+681
plugin/skills/azure-prepare/references/services/container-apps/templates/recipes/cosmos/README.md	-	676	+676
plugin/skills/azure-prepare/references/services/container-apps/templates/recipes/README.md	-	596	+596
plugin/skills/azure-prepare/references/analyze.md	1,003	1,096	+93 (+9%)
plugin/skills/azure-prepare/references/services/container-apps/README.md	334	407	+73 (+22%)
plugin/skills/azure-prepare/references/research.md	2,196	2,250	+54 (+2%)

@github-copilot-for-azure/scripts@1.0.0 tokens
node --import tsx src/tokens/cli.ts check --markdown

📊 Token Limit Check Report

Checked: 740 files
Exceeded: 100 files

⚠️ Files Exceeding Token Limits

File	Tokens	Limit	Over By
.github/skills/analyze-skill-issues/SKILL.md	2109	500	+1609
.github/skills/analyze-test-run/SKILL.md	2471	500	+1971
.github/skills/file-test-bug/SKILL.md	628	500	+128
.github/skills/sensei/SKILL.md	856	500	+356
.github/skills/skill-authoring/SKILL.md	839	500	+339
.github/skills/vally-eval/SKILL.md	1757	500	+1257
plugin/skills/airunway-aks-setup/SKILL.md	1025	500	+525
plugin/skills/appinsights-instrumentation/SKILL.md	937	500	+437
plugin/skills/azure-ai/SKILL.md	820	500	+320
plugin/skills/azure-aigateway/SKILL.md	1261	500	+761
plugin/skills/azure-aigateway/references/policies.md	2342	2000	+342
plugin/skills/azure-cloud-migrate/SKILL.md	1085	500	+585
plugin/skills/azure-cloud-migrate/references/services/container-apps/cloudrun-deployment-guide.md	2029	2000	+29
plugin/skills/azure-cloud-migrate/references/services/container-apps/deployment-guide.md	2458	2000	+458
plugin/skills/azure-cloud-migrate/references/services/container-apps/fargate-deployment-guide.md	2587	2000	+587
plugin/skills/azure-cloud-migrate/references/services/container-apps/spring-deployment-guide.md	3871	2000	+1871
plugin/skills/azure-cloud-migrate/references/services/functions/lambda-to-functions.md	2600	2000	+600
plugin/skills/azure-cloud-migrate/references/services/functions/runtimes/javascript.md	2181	2000	+181
plugin/skills/azure-compliance/SKILL.md	1188	500	+688
plugin/skills/azure-compute/SKILL.md	762	500	+262
plugin/skills/azure-compute/workflows/essential-machine-management/references/emm-enable-flow.md	2344	2000	+344
plugin/skills/azure-compute/workflows/vm-troubleshooter/vm-troubleshooter.md	2509	2000	+509
plugin/skills/azure-deploy/SKILL.md	1645	500	+1145
plugin/skills/azure-deploy/references/pre-deploy-checklist.md	4692	2000	+2692
plugin/skills/azure-deploy/references/recipes/azd/errors.md	4004	2000	+2004
plugin/skills/azure-deploy/references/troubleshooting.md	2038	2000	+38
plugin/skills/azure-diagnostics/SKILL.md	1423	500	+923
plugin/skills/azure-enterprise-infra-planner/SKILL.md	911	500	+411
plugin/skills/azure-enterprise-infra-planner/references/constraints/compute-apps.md	2022	2000	+22
plugin/skills/azure-kubernetes/SKILL.md	2634	500	+2134
plugin/skills/azure-kubernetes/azure-kubernetes-automatic-readiness/SKILL.md	3690	500	+3190
plugin/skills/azure-kusto/SKILL.md	2152	500	+1652
plugin/skills/azure-messaging/SKILL.md	821	500	+321
plugin/skills/azure-prepare/SKILL.md	3145	500	+2645
plugin/skills/azure-prepare/references/aspire.md	4617	2000	+2617
plugin/skills/azure-prepare/references/plan-template.md	2560	2000	+560
plugin/skills/azure-prepare/references/recipes/azd/aspire.md	2275	2000	+275
plugin/skills/azure-prepare/references/recipes/azd/terraform.md	3555	2000	+1555
plugin/skills/azure-prepare/references/research.md	2250	2000	+250
plugin/skills/azure-prepare/references/resources-limits-quotas.md	3322	2000	+1322
plugin/skills/azure-prepare/references/security.md	2147	2000	+147
plugin/skills/azure-prepare/references/services/functions/bicep.md	3043	2000	+1043
plugin/skills/azure-prepare/references/services/functions/templates/recipes/composition.md	2813	2000	+813
plugin/skills/azure-prepare/references/services/functions/terraform.md	3404	2000	+1404
plugin/skills/azure-quotas/SKILL.md	3006	500	+2506
plugin/skills/azure-quotas/references/commands.md	2644	2000	+644
plugin/skills/azure-reliability/SKILL.md	5922	500	+5422
plugin/skills/azure-reliability/references/configure-multi-region.md	4729	2000	+2729
plugin/skills/azure-reliability/references/services/app-service/reliability.md	2591	2000	+591
plugin/skills/azure-resource-lookup/SKILL.md	1367	500	+867
plugin/skills/azure-resource-visualizer/SKILL.md	2122	500	+1622
plugin/skills/azure-storage/SKILL.md	1228	500	+728
plugin/skills/azure-upgrade/SKILL.md	1542	500	+1042
plugin/skills/azure-upgrade/references/languages/java/INSTRUCTION.md	2893	2000	+893
plugin/skills/azure-upgrade/references/languages/java/package-specific/com.microsoft.azure.management.md	2428	2000	+428
plugin/skills/azure-upgrade/references/languages/java/templates/PLAN_TEMPLATE.md	2411	2000	+411
plugin/skills/azure-upgrade/references/languages/java/templates/PROGRESS_TEMPLATE.md	2315	2000	+315
plugin/skills/azure-upgrade/references/languages/java/templates/SUMMARY_TEMPLATE.md	2190	2000	+190
plugin/skills/azure-upgrade/references/services/functions/automation.md	3463	2000	+1463
plugin/skills/azure-upgrade/references/services/functions/consumption-to-flex.md	2773	2000	+773
plugin/skills/azure-validate/SKILL.md	950	500	+450
plugin/skills/entra-agent-id/SKILL.md	3994	500	+3494
plugin/skills/entra-app-registration/SKILL.md	2058	500	+1558
plugin/skills/entra-app-registration/references/api-permissions.md	2545	2000	+545
plugin/skills/entra-app-registration/references/cli-commands.md	2211	2000	+211
plugin/skills/entra-app-registration/references/console-app-example.md	2752	2000	+752
plugin/skills/entra-app-registration/references/oauth-flows.md	2375	2000	+375
plugin/skills/microsoft-foundry/SKILL.md	6166	500	+5666
plugin/skills/microsoft-foundry/finetuning/SKILL.md	1375	500	+875
plugin/skills/microsoft-foundry/foundry-agent/azd-guidance/references/azd-ai-cli.md	2129	2000	+129
plugin/skills/microsoft-foundry/foundry-agent/create/create-hosted.md	7101	2000	+5101
plugin/skills/microsoft-foundry/foundry-agent/create/quick-start-hosted.md	5246	2000	+3246
plugin/skills/microsoft-foundry/foundry-agent/create/references/foundry-tool-catalog.md	10891	2000	+8891
plugin/skills/microsoft-foundry/foundry-agent/create/references/local-run.md	2252	2000	+252
plugin/skills/microsoft-foundry/foundry-agent/create/references/toolbox-reference.md	3137	2000	+1137
plugin/skills/microsoft-foundry/foundry-agent/create/references/tools.md	2359	2000	+359
plugin/skills/microsoft-foundry/foundry-agent/create/references/use-toolbox-in-hosted-agent.md	4288	2000	+2288
plugin/skills/microsoft-foundry/foundry-agent/deploy/deploy.md	4897	2000	+2897
plugin/skills/microsoft-foundry/foundry-agent/eval-datasets/eval-datasets.md	2863	2000	+863
plugin/skills/microsoft-foundry/foundry-agent/eval-datasets/references/generate-seed-dataset.md	2212	2000	+212
plugin/skills/microsoft-foundry/foundry-agent/eval-datasets/references/trace-to-dataset.md	4325	2000	+2325
plugin/skills/microsoft-foundry/foundry-agent/invocations-ws/invocations-ws.md	2652	2000	+652
plugin/skills/microsoft-foundry/foundry-agent/observe/observe.md	3856	2000	+1856
plugin/skills/microsoft-foundry/foundry-agent/observe/references/continuous-eval.md	3855	2000	+1855
plugin/skills/microsoft-foundry/foundry-agent/observe/references/evaluate-step.md	2175	2000	+175
plugin/skills/microsoft-foundry/foundry-agent/observe/references/evaluation-suite-generation.md	3134	2000	+1134
plugin/skills/microsoft-foundry/foundry-agent/routine/routine.md	2032	2000	+32
plugin/skills/microsoft-foundry/foundry-agent/trace/references/kql-templates.md	2701	2000	+701
plugin/skills/microsoft-foundry/models/deploy-model/SKILL.md	1805	500	+1305
plugin/skills/microsoft-foundry/models/deploy-model/capacity/SKILL.md	1739	500	+1239
plugin/skills/microsoft-foundry/models/deploy-model/customize/SKILL.md	2235	500	+1735
plugin/skills/microsoft-foundry/models/deploy-model/customize/references/customize-workflow.md	3335	2000	+1335
plugin/skills/microsoft-foundry/models/deploy-model/preset/SKILL.md	1226	500	+726
plugin/skills/microsoft-foundry/models/deploy-model/preset/references/preset-workflow.md	5534	2000	+3534
plugin/skills/microsoft-foundry/project/create/create-foundry-project.md	2283	2000	+283
plugin/skills/microsoft-foundry/quota/quota.md	2288	2000	+288
plugin/skills/microsoft-foundry/quota/references/capacity-planning.md	2080	2000	+80
plugin/skills/microsoft-foundry/references/agent-metadata-contract.md	2217	2000	+217
plugin/skills/microsoft-foundry/references/sdk/foundry-sdk-py.md	2162	2000	+162
plugin/skills/python-appservice-deploy/SKILL.md	688	500	+188

Consider moving content to references/ subdirectories.

---

Automated token analysis. See skill authoring guidelines for best practices.

[jongio]

Solid foundation for Container Apps templates. The base + composable recipes architecture is clean and the workload type coverage is thorough.

Two blocking issues and several correctness problems in the Bicep/SDK snippets that would produce broken deployments if copy-pasted. CI is also red.

Key themes:

• RBAC: wrong resource type for Cosmos in composition.md, wrong role for Redis data access
• KEDA auth: three files show scalers with no auth config, contradicting the "disableLocalAuth" stance
• Missing identity/env config in event job template and Functions-on-ACA storage auth
• CI: azure-prepare version needs bump from 1.1.8 to 1.1.9+. All 15 new files are orphaned - they aren't linked from the reference chain. Add a - [Templates](templates/selection.md) link to container-apps/README.md to fix.

[simonjj]

Hey Paul — really impressive scope on this one. The template selection tree and composition algorithm are a great pattern, and having all the recipes in one place is exactly what we needed.

I went through everything from the ACA domain side and found a handful of things that would cause issues at deploy time — mostly around the managed identity wiring (KEDA scalers needed the identity field instead of secret-based auth, Cosmos uses sqlRoleAssignments for data-plane RBAC, Redis needs the Data Owner role + useEntraID for Dapr, etc.). Also fixed the Node.js Redis SDK pattern, wired up some missing params, and linked the 15 template files into the skill reference chain so CI passes.

All the details are in #2026 which targets your branch. Tested across GPT-5 mini, GPT-5.3-Codex, Claude Haiku 4.5, Sonnet 4.6, and Opus 4.6 — all passing.

Thanks for putting this together!

[Copilot]

Pull request overview

Copilot reviewed 19 out of 19 changed files in this pull request and generated 6 comments.

[paulyuk]

🧪 Validation Results — Cosmos DB & Redis Patterns

Tested Bicep patterns from this PR for correctness (compilation + E2E deployment).

Phase 1: Bicep Compilation

Test	Status	Details
Cosmos DB module (cosmos.bicep)	✅ PASS	az bicep build — compiles clean (API 2024-05-15, disableLocalAuth, serverless, sqlRoleAssignments)
Redis module (redis.bicep)	✅ PASS	az bicep build — compiles clean (API 2024-03-01, Standard C1, aad-enabled, RBAC role assignment)
Cosmos RBAC composition pattern (composition.md)	✅ PASS	az bicep build — sqlRoleAssignments with Data Contributor GUID compiles clean
Redis Dapr state store component	✅ PASS	az bicep build — Dapr state.redis component with useEntraID metadata compiles clean

Phase 2: Cosmos DB E2E (azd up)

Test	Status	Details
azd up — full deployment	✅ PASS	functions-quickstart-dotnet-azd-cosmosdb template deployed to eastus2 in ~13m 29s. All 7 resources provisioned: Cosmos DB (disableLocalAuth + serverless), Function App, Storage, App Insights, Log Analytics, App Service Plan, Resource Group
RBAC pattern (sqlRoleAssignments)	✅ PASS	Cosmos DB Built-in Data Contributor (00000000-0000-0000-0000-000000000002) assigned via UAMI — same pattern as PR
azd down --purge --force	✅ PASS	All resources deleted and purged in ~16m 17s

Phase 3: Redis Validation

Test	Status	Details
Redis Bicep compiles (Standard C1 + aad-enabled)	✅ PASS	See Phase 1 above
RBAC role GUID e12a10f1-dcd0-4ee7-abb0-0b2e24e345e7 valid	✅ PASS	Confirmed via Microsoft docs — "Redis Cache Data Owner" is a valid built-in role. Note: role not listed in current subscription's az role definition list (may require Redis resource to be registered) but GUID is correct per Azure RBAC docs
Dapr component includes useEntraID	✅ PASS	Dapr state.redis metadata includes useEntraID: true, enableTLS: true, and azureClientId — compiles and matches Dapr docs

Summary

8/8 tests passed. All Bicep patterns from PR #1636 compile successfully and the Cosmos DB pattern deploys end-to-end with RBAC + UAMI. Redis patterns compile clean and role GUIDs are verified against Azure docs.

Tested with Bicep v0.35.1, azd 1.11.0, Azure CLI on Windows. Subscription: Azure - Paul Yuknewicz (Corp).

[Copilot]

Pull request overview

Copilot reviewed 18 out of 18 changed files in this pull request and generated 7 comments.

[paulyuk]

🧪 E2E Skill Validation — Container Apps Templates (PR #1636)

Tested the skill templates end-to-end by following the composition algorithm to generate real deployable projects.

Results

Test	Skill Files Used	Status	Details
Container Apps + Cosmos DB	selection.md, api.md, cosmos/README.md, composition.md	✅ Pass	Infra provisioned in 3m, app deployed and connected to Cosmos via UAMI. /health returned {"status":"ok","cosmos":"connected","databases":1}
Container Apps + Redis	selection.md, api.md, redis/README.md, composition.md	⚠️ Partial — recipe bugs found	Infra provisioned (22m for Standard C1). App deployed. Two recipe bugs found (see below).

Key Validations

• Cosmos disableLocalAuth: true deploys successfully
• Cosmos sqlRoleAssignments RBAC pattern works (not ARM roleAssignments) ✅
• Redis Standard C1 with aad-enabled: true deploys successfully
• ❌ Redis Data Owner RBAC role (e12a10f1-...) does not exist — recipe uses wrong RBAC pattern
• UAMI auth works for Cosmos
• ⚠️ UAMI auth for Redis needs recipe fix (wrong username — see bug Operating system and architecture is not supported by the GitHub Copilot for Azure extension (Linux ARM64/some distros) #2)
• azd down --purge --force cleans up successfully for both

🐛 Bugs Found in Redis Recipe

Bug 1: Non-existent RBAC role GUID
The recipe (recipes/redis/README.md) uses Microsoft.Authorization/roleAssignments with GUID e12a10f1-dcd0-4ee7-abb0-0b2e24e345e7 ("Redis Cache Data Owner"). This role definition does not exist in Azure.

az role definition list --name "Redis Cache Data Owner"  →  []
az role definition list --query "[?name=='e12a10f1-dcd0-4ee7-abb0-0b2e24e345e7']"  →  []

Available Redis roles: only Redis Cache Contributor (e0f68234-..., management plane).

Fix: Redis uses Microsoft.Cache/redis/accessPolicyAssignments for data plane RBAC, not ARM role assignments:

resource accessPolicy 'Microsoft.Cache/redis/accessPolicyAssignments@2024-03-01' = {
  parent: redis
  name: 'uami-data-owner'
  properties: {
    objectId: principalId
    objectIdAlias: 'UAMI'
    accessPolicyName: 'Data Owner'
  }
}

Bug 2: Redis connection code uses wrong identity field as username
The recipe's SDK example uses AZURE_CLIENT_ID (UAMI client ID) as the Redis username, but Redis Entra ID auth expects the principal ID (object ID). This causes ERR WRONGPASS invalid username-password pair.

• UAMI clientId: 1fa0aa50-88ac-45c4-a8e9-80f10f78a8d9 ← recipe passes this as username
• UAMI principalId: 32b29406-9ea0-4f88-906b-4a91d8b33587 ← Redis expects this (matches accessPolicyAssignment.objectId)

Fix: Add a separate env var for the principal ID and use it as the Redis username.

Deployment Logs

Cosmos deployment output (✅ full success)

Provision (3m 1s):

(✓) Done: Resource group: rg-pr1636-cosmos-test (2.298s)
(✓) Done: Container Registry: acrtoovqhwa6zujy (8.062s)
(✓) Done: Log Analytics workspace: log-toovqhwa6zujy (22.07s)
(✓) Done: Azure Cosmos DB: cosmos-toovqhwa6zujy (1m8.232s)
(✓) Done: Container Apps Environment: env-toovqhwa6zujy (58.343s)
(✓) Done: Container App: api-toovqhwa6zujy (18.352s)
SUCCESS: provisioned in 3 minutes 1 second

Deploy (1m 2s):

Endpoint: https://api-toovqhwa6zujy.orangesky-65cd2fe8.eastus2.azurecontainerapps.io/
SUCCESS: deployed in 1 minute 2 seconds

Verification:

GET / → 200 {"status":"ok","service":"cosmos-api-test"}
GET /health → 200 {"status":"ok","cosmos":"connected","databases":1}

Cleanup:

SUCCESS: removed from Azure in 17 minutes 15 seconds

Redis deployment output (⚠️ infra OK, recipe bugs found)

First attempt — recipe as-is: FAILED

ERROR: RoleDefinitionDoesNotExist: The specified role definition with ID
'e12a10f1dcd04ee7abb00b2e24e345e7' does not exist.

Second attempt — fixed RBAC to accessPolicyAssignments: PASSED

Provision (22m 28s):

(✓) Done: Resource group: rg-pr1636-redis-test (2.112s)
(✓) Done: Container Registry: acryrl6ltnonrqts (7.537s)
(✓) Done: Log Analytics workspace: log-yrl6ltnonrqts (21.799s)
(✓) Done: Container Apps Environment: env-yrl6ltnonrqts (38.532s)
(✓) Done: Cache for Redis: redis-yrl6ltnonrqts (19m51.725s)
SUCCESS: provisioned in 22 minutes 28 seconds

Deploy (1m 0s):

Endpoint: https://api-yrl6ltnonrqts.purpledune-a2769f12.eastus2.azurecontainerapps.io/
SUCCESS: deployed in 1 minute

Verification:

GET / → 200 {"status":"ok","service":"redis-api-test"}
GET /health → 500 {"status":"error","message":"ERR WRONGPASS invalid username-password pair"}

Redis access policy confirmed via CLI:

{"accessPolicyName":"Data Owner","objectId":"32b29406-...","provisioningState":"Succeeded"}

Cleanup:

SUCCESS: removed from Azure in 10 minutes 14 seconds

[jongio]

Addresses my previous feedback. The decision tree split into Part A (base template selection) and Part B (recipe layering) makes the two-phase flow clear. All prior items resolved.

[JasonYeMSFT]

@paulyuk Please resolve the remaining comments so we can merge this PR.

[github-actions]

This PR has been automatically closed because it has unresolved review comments and no new commits in the last 28 days.

If you would still like to merge these changes, please:

1. Resolve all outstanding review comments
2. Reopen this PR

Thank you for your contribution!

[paulyuk]

Reopened and pushed 6859bd0 addressing all outstanding review comments on this PR. Every unresolved thread has been resolved. Validators run locally: frontmatter and references pass, targeted skill tests pass, and the changed files are within token budget (the repo-wide tokens check failures are pre-existing baseline overages on unrelated files, not introduced here). Ready for another look — Gap-2 Container Apps Develop.

[jongio]

Re-reviewing after my prior review was dismissed. The base-plus-recipe composition architecture remains solid. Security posture is correct (UAMI everywhere, disableLocalAuth on backing services, exact RBAC GUIDs). The TypeScript change for 0.0.0-placeholder version validation is clean and scoped correctly.

Merge state is BLOCKED (needs required approvals), though conflicts appear resolved now. One consistency issue in the scaling documentation below.

The 61 existing comments cover the major findings thoroughly. Most of what I'd flag is already raised by prior reviewers. Adding one note on an inconsistency that would produce broken deployments if the standalone example is copy-pasted.

[paulyuk]

Note on the red eval check: it's a pre-existing main-branch failure, not from this PR. vally's --strict orphan-files walk flags four azure-compute/references/* files that are only reached via ../../references/ links it doesn't follow. Fixed separately in #2744 so this PR stays in-scope. Every other check is green.

[jongio]

Verified the two new commits against KEDA scaler specs:

1. Service Bus scaler (9833598): identity: userAssignedIdentityId added to the standalone example. Now consistent with the main Bicep block that already had it.

2. Event Hubs scaler (552b816): namespace renamed to eventHubNamespace (correct KEDA azure-eventhub metadata key). Added required checkpoint fields storageAccountName and blobContainer for consumer group progress tracking.

All three standalone scaling examples (Service Bus, Event Hubs, Storage Queue) now carry proper UAMI identity config, which is required given disableLocalAuth on the backing services. No remaining technical issues from my side. Still BLOCKED on required approvals.

[paulyuk]

Hi @jongio, hope you had a good July 4th weekend. Now that we're back for the first business day after the holiday, could you take a look at this one when you get a chance? It's ready for review and just needs an approval to land. The only red check is the pre-existing repo-wide eval failure, which is fixed separately by #2744. Thanks!

[jongio]

One inline note on the microservice environment Bicep. The prior 61 comments have been addressed per jongio's 7/4 verification, and the frontmatter CLI change is correctly scoped. No blockers.

[paulyuk]

Hi @jongio, back at it on the first business day after the July 4th weekend. This one is ready for review whenever you get a chance. The only red check is the pre-existing repo-wide eval failure, which is already fixed on main by the vally 0.7.0 update (#2759), so it just needs a re-run to go green. A quick look and approval would let it land. Thanks!

[wbreza]

Code Review — PR #1636 (Container Apps Develop templates)

Reviewed at head f28d838b. This is a documentation/skill-content PR: 18 markdown reference files adding ACA scaffolding (selection tree, 6 base templates, 6 recipes, composition algorithm) to the azure-prepare skill. The earlier cli.ts validator change was reverted in this branch, so the PR is now content-only.

Summary

Priority	Count
Critical	0
High	0
Medium	1
Low	0
Total	1

Overall Assessment: Approve with one suggestion — a broken Python code example (inline).

🟡 Medium (1)

1. Broken Python connection snippet — recipes/postgres/README.md:94 contains a literal ****** where the password=token.token, argument belongs, which is a Python syntax error. The adjacent Node.js example (line 116) is correct. See inline comment.

✅ What Looks Good

• Security posture is consistent and correct across recipes: disableLocalAuth: true (Cosmos, Service Bus), passwordAuth: 'Disabled' (Postgres), AAD-enabled Redis, managed identity end-to-end, no hardcoded secrets.
• jongio's earlier @secure() flag on microservice.md (Log Analytics shared key) is addressed.
• Bicep resource types and apiVersions are valid; scale/KEDA rules and ingress config are well-formed and consistent across templates.
• PR description scope is accurate — the promised base templates, recipes, and composition algorithm are all delivered.

Notes (non-blocking)

• The eval CI check is failing, but every one of the 21 evals reports score: 0.0% with the identical error Authentication failed: Failed to fetch PAT user login (401): GitHub returned: Bad credentials. This is an environmental/credential failure in the eval runner, unrelated to this PR's content.
• web-app.md:98 uses app.identity.userAssignedIdentities[userAssignedIdentityId].principalId. This was verified as a valid Bicep pattern (ARM populates principalId/clientId in the resource's runtime response for user-assigned identities) — no change needed.

[wbreza]

[content-accuracy] This Python psycopg2.connect(...) example is broken: line 94 is a literal ******, which is a Python syntax error and leaves the connection with no password. The equivalent Node.js example below (line 116) correctly passes the token. Supply the AAD token as the password to match it.

Suggested change

	password=token.token,
	password=token.token,