Skip to main content

Azure

Overview​

This section documents how the "master tool" (this repo) is hosted and operates with resources in the Azure tenant across environments.

At a high level:

  • CI/CD builds container images from this repo using GitHub Actions.
  • The image is pushed to an Azure Container Registry (ACR).
  • An Azure App Service (Linux / container) is configured to run the image for each environment.
  • The app connects to an environment-specific SQL Server database.
  • The app calls Azure AI Inference (typically Azure AI Foundry model deployments) using Managed Identity.
  • TAP workflows also call Azure AI Content Safety (tenant-hosted resource; Managed Identity).
  • External callers typically reach the app through APIM in the tenant, which enforces JWT + subscription key.

Infrastructure Templates (Bicep)​

  • Infrastructure Overview (infrastructure-overview): Architecture diagram and complete component reference
  • Template Parameters (template-parameters): Complete parameter reference for the Bicep template
  • RBAC Permissions (permissions): Permission mapping for the managed identity
  • Environment Configurations (environments): Differences between dev, staging, and prod
  • Networking & Security (networking): VNet, Private Endpoints, Service Endpoints

Operations​

  • Deployment (deployment): how we build/push images, tag them per environment, and deploy to App Service.
  • Services (services): what each Azure service does (App Service, ACR, SQL Server, Azure AI Foundry (Inference), Content Safety, APIM).
  • Authentication (authentication): APIM auth model (JWT + subscription key) and Managed Identity usage from the app.

GitHub Actions & Identity​

  • GitHub Actions: Workflows under .github/workflows/ build, deploy, reconcile, validate, and smoke test environments.
  • GitHub OIDC identity: GitHub environments provide Azure credentials through OIDC and scoped secrets.