feat: transfer Foundry provisioning to projects#9133
Open
huimiu wants to merge 7 commits into
Open
Conversation
|
Azure Pipelines: Successfully started running 2 pipeline(s). 20 pipeline(s) were filtered out due to trigger conditions. There may be pipelines that require an authorized user to comment /azp run to run. |
github-actions
Bot
added
ext-agents
huimiu
requested review from
JeffreyCA,
RickWinter,
glharper,
hemarina,
tg-msft,
therealjohn,
trangevi,
trrwilson and
vhvb1989
as code owners
|
Azure Pipelines: Successfully started running 2 pipeline(s). 20 pipeline(s) were filtered out due to trigger conditions. There may be pipelines that require an authorized user to comment /azp run to run. |
📋 Prioritization NoteThanks for the contribution! The linked issue isn't in the current milestone yet. |
Contributor
There was a problem hiding this comment.
Pull request overview
Transfers Foundry provisioning ownership from azure.ai.agents to azure.ai.projects, including lifecycle projection, validation, infrastructure synthesis, and coordinated versioning.
Changes:
- Registers the Foundry provider and validation checks in Projects.
- Moves deployment projection while retaining legacy Agents fallback.
- Adds synchronized release metadata, tests, templates, and documentation.
Reviewed changes
Copilot reviewed 66 out of 67 changed files in this pull request and generated 9 comments.
Show a summary per file
| File | Description |
|---|---|
docs/reference/telemetry-data.md |
Updates telemetry ownership. |
cli/azd/extensions/azure.ai.projects/version.txt |
Bumps Projects version. |
cli/azd/extensions/azure.ai.projects/README.md |
Documents project ownership. |
cli/azd/extensions/azure.ai.projects/internal/version/version.go |
Adds build metadata. |
cli/azd/extensions/azure.ai.projects/internal/synthesis/templates/terraform/variables.tf |
Defines Terraform inputs. |
cli/azd/extensions/azure.ai.projects/internal/synthesis/templates/terraform/provider.tf |
Configures Terraform providers. |
cli/azd/extensions/azure.ai.projects/internal/synthesis/templates/terraform/outputs.tf.tmpl |
Defines conditional outputs. |
cli/azd/extensions/azure.ai.projects/internal/synthesis/templates/terraform/main.tf |
Provisions core Foundry resources. |
cli/azd/extensions/azure.ai.projects/internal/synthesis/templates/terraform/acr.tf |
Provisions connected ACR. |
cli/azd/extensions/azure.ai.projects/internal/synthesis/templates/modules/subnet.bicep |
Adds subnet module. |
cli/azd/extensions/azure.ai.projects/internal/synthesis/templates/modules/resources.bicep |
Defines Foundry resources. |
cli/azd/extensions/azure.ai.projects/internal/synthesis/templates/modules/private-endpoint-dns.bicep |
Adds private endpoint and DNS. |
cli/azd/extensions/azure.ai.projects/internal/synthesis/templates/modules/network.bicep |
Adds VNet wiring. |
cli/azd/extensions/azure.ai.projects/internal/synthesis/templates/modules/connections.bicep |
Provisions project connections. |
cli/azd/extensions/azure.ai.projects/internal/synthesis/templates/modules/acr.bicep |
Adds Bicep ACR module. |
cli/azd/extensions/azure.ai.projects/internal/synthesis/templates/main.bicep |
Adds greenfield template. |
cli/azd/extensions/azure.ai.projects/internal/synthesis/templates/brownfield.bicep |
Adds existing-project template. |
cli/azd/extensions/azure.ai.projects/internal/synthesis/templates/brownfield.arm.json |
Embeds compiled brownfield ARM. |
cli/azd/extensions/azure.ai.projects/internal/synthesis/templates/abbreviations.json |
Defines resource abbreviations. |
cli/azd/extensions/azure.ai.projects/internal/synthesis/templates_embed.go |
Embeds provisioning templates. |
cli/azd/extensions/azure.ai.projects/internal/synthesis/synthesizer.go |
Adds configuration synthesis. |
cli/azd/extensions/azure.ai.projects/internal/synthesis/schema_test.go |
Tests schema and ARM parity. |
cli/azd/extensions/azure.ai.projects/internal/synthesis/parity_test.go |
Enforces Agents synthesis parity. |
cli/azd/extensions/azure.ai.projects/internal/provisioning/resource_group_location_check.go |
Moves location validation. |
cli/azd/extensions/azure.ai.projects/internal/provisioning/resource_group_location_check_validate_test.go |
Ports validation tests. |
cli/azd/extensions/azure.ai.projects/internal/provisioning/resource_group_location_check_test.go |
Ports location tests. |
cli/azd/extensions/azure.ai.projects/internal/provisioning/provisioning_provider.go |
Defines provider constants. |
cli/azd/extensions/azure.ai.projects/internal/provisioning/preview_helpers.go |
Moves preview helpers. |
cli/azd/extensions/azure.ai.projects/internal/provisioning/preview_helpers_test.go |
Ports preview tests. |
cli/azd/extensions/azure.ai.projects/internal/provisioning/ondisk_template.go |
Moves on-disk template support. |
cli/azd/extensions/azure.ai.projects/internal/provisioning/ondisk_template_test.go |
Ports template tests. |
cli/azd/extensions/azure.ai.projects/internal/provisioning/foundry_provisioning_provider.go |
Moves the Foundry provider. |
cli/azd/extensions/azure.ai.projects/internal/provisioning/foundry_provisioning_provider_test.go |
Ports provider tests. |
cli/azd/extensions/azure.ai.projects/internal/provisioning/foundry_provisioning_provider_resolveenv_test.go |
Tests environment resolution. |
cli/azd/extensions/azure.ai.projects/internal/provisioning/foundry_provisioning_provider_destroy_confirm_test.go |
Tests destroy confirmation. |
cli/azd/extensions/azure.ai.projects/internal/provisioning/foundry_provisioning_provider_brownfield_acr_test.go |
Tests brownfield ACR. |
cli/azd/extensions/azure.ai.projects/internal/provisioning/contract_parity_test.go |
Enforces migration contract parity. |
cli/azd/extensions/azure.ai.projects/internal/exterrors/errors.go |
Adds provider error helpers. |
cli/azd/extensions/azure.ai.projects/internal/exterrors/codes.go |
Adds provisioning error codes. |
cli/azd/extensions/azure.ai.projects/internal/cmd/version.go |
Uses shared version metadata. |
cli/azd/extensions/azure.ai.projects/internal/cmd/service_target.go |
Updates ownership documentation. |
cli/azd/extensions/azure.ai.projects/internal/cmd/root.go |
Registers providers and handlers. |
cli/azd/extensions/azure.ai.projects/internal/cmd/project_service_config.go |
Projects deployment environment data. |
cli/azd/extensions/azure.ai.projects/internal/cmd/project_service_config_test.go |
Tests lifecycle projection. |
cli/azd/extensions/azure.ai.projects/internal/cmd/ownership_test.go |
Tests extension ownership metadata. |
cli/azd/extensions/azure.ai.projects/internal/azure/client_options.go |
Configures Azure SDK clients. |
cli/azd/extensions/azure.ai.projects/go.sum |
Updates dependency checksums. |
cli/azd/extensions/azure.ai.projects/go.mod |
Adds provisioning dependencies. |
cli/azd/extensions/azure.ai.projects/extension.yaml |
Declares provider ownership. |
cli/azd/extensions/azure.ai.projects/cspell.yaml |
Adds spelling terms. |
cli/azd/extensions/azure.ai.projects/ci-build.ps1 |
Updates CI linker metadata. |
cli/azd/extensions/azure.ai.projects/CHANGELOG.md |
Adds Projects release notes. |
cli/azd/extensions/azure.ai.projects/build.sh |
Updates Unix linker metadata. |
cli/azd/extensions/azure.ai.projects/build.ps1 |
Updates Windows linker metadata. |
cli/azd/extensions/azure.ai.projects/AGENTS.md |
Documents ownership and release flow. |
cli/azd/extensions/azure.ai.agents/version.txt |
Bumps Agents version. |
cli/azd/extensions/azure.ai.agents/README.md |
Documents transferred ownership. |
cli/azd/extensions/azure.ai.agents/internal/project/provisioning_provider.go |
Updates provider ownership comment. |
cli/azd/extensions/azure.ai.agents/internal/cmd/resource_services.go |
Retains legacy deployment fallback. |
cli/azd/extensions/azure.ai.agents/internal/cmd/resource_services_test.go |
Tests split and legacy behavior. |
cli/azd/extensions/azure.ai.agents/internal/cmd/listen.go |
Removes provider registration. |
cli/azd/extensions/azure.ai.agents/extension.yaml |
Adds Projects dependency. |
cli/azd/extensions/azure.ai.agents/docs/private-networking.md |
Updates networking ownership docs. |
cli/azd/extensions/azure.ai.agents/CHANGELOG.md |
Adds Agents release notes. |
cli/azd/extensions/azure.ai.agents/AGENTS.md |
Documents coordinated release flow. |
jongio
reviewed
Jul 14, 2026
jongio
left a comment
jongio
left a comment
Member
There was a problem hiding this comment.
One test-coverage gap worth closing on the new synthesizer.
Contributor
There was a problem hiding this comment.
Pull request overview
Copilot reviewed 76 out of 77 changed files in this pull request and generated no new comments.
Comments suppressed due to low confidence (3)
cli/azd/extensions/azure.ai.projects/internal/provisioning/foundry_provisioning_provider.go:892
- [azd-code-reviewer] ARM deployment parameter objects use
valueeven when the template parameter issecurestring;secureValueis not part of the deployments REST schema. Because this map is sent directly througharmresources.Deployment, every brownfield reconcile includes an invalidconnectionsparameter and can be rejected before deployment. Keep the template parameter marked@secure(), but send its value in the standard envelope.
cli/azd/extensions/azure.ai.projects/internal/provisioning/foundry_provisioning_provider.go:157 - [azd-code-reviewer] The provider now recognizes an
endpointloaded through$ref, but the provision validation gate still classifies brownfield projects withfoundryServiceEndpoint(rawYAML, svcName), which does not resolve references. A ref-based brownfield project can therefore be treated as greenfield and blocked by the resource-group location check beforeInitializereaches this code. Update the validation check to usesynthesis.ProjectEndpointwith the project path as well.
cli/azd/extensions/azure.ai.projects/internal/provisioning/foundry_provisioning_provider.go:1754 secureValueis not a valid ARM deployment parameter envelope for the deployments REST API; secure template parameters should still be supplied with the standard{ "value": ... }wrapper. Because synthesis always includesconnections, greenfield provisioning can send an invalid parameter object even when the connection list is empty.
jongio
approved these changes
Jul 14, 2026
jongio
left a comment
jongio
left a comment
Member
There was a problem hiding this comment.
Re-reviewed the latest push. The sibling $ref resolution I flagged is now handled through loadProjectService, with projectRoot threaded into deriveIncludeAcr and collectConnections, so agents and connections declared via a service-level $ref are resolved before decoding. The gRPC project-config path resolves refs too, and connections now flows as a @secure() JSON parameter end to end. Tests cover both the ref-resolution and secure-parameter paths.
huimiu
force-pushed
the
hui/own-ai-project-service
branch
from
0695ccf to
c2ba868
Compare
Contributor
There was a problem hiding this comment.
Pull request overview
Copilot reviewed 76 out of 77 changed files in this pull request and generated 2 comments.
Comments suppressed due to low confidence (1)
cli/azd/extensions/azure.ai.projects/internal/provisioning/foundry_provisioning_provider.go:157
- azd-code-reviewer: This ref-aware endpoint lookup is inconsistent with
ResourceGroupLocationCheck.isBrownfieldFoundryProject, which still callsfoundryServiceEndpointon the raw YAML. Whenendpointcomes from a service$ref(a case now covered by the synthesizer tests), provision validation treats the project as greenfield and can block on an unrelated resource-group location mismatch before this provider runs. Use the same ref-aware resolver in the validation check and cover that gate with a test.
| capacity: 50 | ||
| ``` | ||
|
|
||
| When `endpoint` is omitted, `azd provision` creates a Foundry account and project. When it is set, provisioning reuses that project and reconciles the declarations that can be applied to an existing account. |
Comment on lines
+61
to
+67
| run: | | ||
| pwsh -File ci-build.ps1 -OutputFileName azure-ai-projects-linux-amd64 -Version "$(cat version.txt | tr -d '\r\n')" | ||
| mkdir -p bin | ||
| mv azure-ai-projects-linux-amd64 bin/ | ||
| azd x pack | ||
| azd x publish | ||
| azd extension install azure.ai.projects --source local --force --no-prompt |
jongio
approved these changes
Jul 14, 2026
jongio
left a comment
jongio
left a comment
Member
There was a problem hiding this comment.
Re-reviewed the 3 new commits since my last approval. The connections parameter now uses the value envelope instead of secureValue, which is the valid ARM parameter key, so the value actually reaches the deployment. Security is still enforced by @secure() on the connections param in both main.bicep and brownfield.bicep, so nothing leaks in deployment history. Tests cover the new envelope, and the agents workflow now runs the projects unit tests.
trangevi
requested changes
Jul 14, 2026
| description: Ship agents with Microsoft Foundry from your terminal. (Beta) | ||
| usage: azd ai agent <command> [options] | ||
| # NOTE: Make sure version.txt is in sync with this version. | ||
| version: 1.0.0-beta.5 |
Member
There was a problem hiding this comment.
Why are we doing a version bump as a part of this PR?
| // FoundryProviderName is the value written to `infra.provider` in | ||
| // azure.yaml by `azd ai agent init` and looked up by azd's provider | ||
| // resolver to dispatch provisioning to this extension. | ||
| // resolver to dispatch provisioning to azure.ai.projects. |
Member
There was a problem hiding this comment.
If provisioning is being handled by azure.ai.projects, what is this file for?
| param connections connectionsType = [] | ||
| @description('JSON-encoded Foundry project connections to create.') | ||
| @secure() | ||
| param connections string = '' |
Member
There was a problem hiding this comment.
Why is the handling here needing to change?
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Fixes: #9134
Summary
microsoft.foundryprovider and validation check fromazure.ai.agentstoazure.ai.projects.azure.ai.projects1.0.0-beta.3 andazure.ai.agents1.0.0-beta.6.Validation
go test ./... -count=1andgo build ./...in both extension modules.golangci-lint run ./...in both extension modules.Release coordination
Publish both extension artifacts before atomically updating their registry entries and the
microsoft.foundrymeta-package. Mixed old/new extension versions cannot register the provider together.