feat(azure-vm-starterkit): add missing meshstack_integration.tf (BBD + permissions)

[grubmeshi]

What

The azure-virtual-machine-starterkit module shipped only its buildingblock/ implementation — it never had a meshstack_integration.tf. So no building block definition was ever created for it, which means no permissions array / ephemeral run key was ever wired up. It looks forgotten and never tested end-to-end.

Its buildingblock creates a meshstack_project, a meshstack_tenant_v4, and a composed Azure VM child building block via provider "meshstack" {} — which only works with the auto-injected ephemeral MESHSTACK_API_TOKEN that a BBD permissions array grants.

Change

Add meshstack_integration.tf (the BBD), modeled on the AKS/SKE starter kits, including:

• permissions with MANAGED_BUILDINGBLOCK_SAVE (the same fix just applied to SKE/AKS on main) so bumping the composed Azure VM child block to a new definition version succeeds — plain BUILDINGBLOCK_SAVE cannot change a block's version.
• inputs mapped from buildingblock/variables.tf, hub/meshstack shared vars, building_block_definition output.

⚠️ Needs your review, @malhussan (original author)

This was reconstructed and not tested end-to-end. Please sanity-check:

• Input assignment types — I guessed USER_INPUT vs STATIC (e.g. vm_location, vm_size, vm_os_type as user inputs; azure_vm_definition_version_uuid, landing_zone_identifier, full_platform_identifier as static). Adjust to intent.
• Composed BBD wiring — azure_vm_definition_version_uuid is passed as a flat STATIC input (AKS pattern); confirm that's how the Azure VM BBD should be referenced.
• vm_admin_password declared sensitive = {} and forwarded to the child — verify the sensitive plumbing.
• readme / summary output wording.

🤖 Generated with Claude Code

[github-actions]

Scorecard Check

Scorecard run on commit de4bb443be9f1226f7408760bd8fac16ef249e1d relative to origin/main

📊 meshstack-hub Module Scorecard

Generated: 2026-07-07 | Modules scanned: 1 | Categories: 5

📋 Per-Module Category Summary

Score per category per building block. n/a = category does not apply to this module.

Module	Overall	Core Structure	Integration	Azure Backplane	STACKIT Backplane	Testing
azure/azure-virtual-machine-starterkit	🟡 74%	🟢 83%	🟢 100%	🔴 44%	n/a	🔴 33%

⚠️ 1 module has failing checks — failing categories are expanded below.

Core Structure — some checks failing

Basic module file structure and documentation — applies to 1 modules

Module	Score	📦	🔗	📋	📝	🖼️	📌	🔒
azure/azure-virtual-machine-starterkit	🟢 83%	✅	✅	➖	✅	❌	✅	✅

Core Structure — Summary

Emoji	Criterion	Coverage	Status
📦	buildingblock/ directory exists	1/1	🟢 100%
🔗	meshstack_integration.tf present	1/1	🟢 100%
📋	buildingblock/APP_TEAM_README.md present (no-integration fallback)	n/a	—
📝	buildingblock/README.md with YAML front-matter	1/1	🟢 100%
🖼️	buildingblock/logo.png included	0/1	🔴 0%
📌	buildingblock/versions.tf present	1/1	🟢 100%
🔒	Provider versions use minimum constraint (>=)	1/1	🟢 100%

Integration — ✅ all passing

meshstack_integration.tf conventions — applies to 1 modules

Module	Score	🏷️	🏢	📤	🔌	📎	🔀	📋	🏷️	🧱	📖	📝	📊	🚫	🔄
azure/azure-virtual-machine-starterkit	🟢 100%	✅	✅	✅	✅	✅	✅	✅	✅	✅	✅	✅	✅	✅	➖

Integration — Summary

Emoji	Criterion	Coverage	Status
🏷️	variable "hub" in integration	1/1	🟢 100%
🏢	variable "meshstack" in integration	1/1	🟢 100%
📤	building_block_definition output exposed	1/1	🟢 100%
🔌	meshcloud/meshstack in required_providers	1/1	🟢 100%
📎	backplane source uses var.hub.git_ref	1/1	🟢 100%
🔀	ref_name uses var.hub.git_ref	1/1	🟢 100%
📋	version_spec.draft uses var.hub.bbd_draft	1/1	🟢 100%
🏷️	BBD metadata.tags forwards var.meshstack.tags	1/1	🟢 100%
🧱	BBD input argument vars with optional() have explicit defaults	1/1	🟢 100%
📖	BBD readme field present	1/1	🟢 100%
📝	BBD readme starts with plain-text description (no heading)	1/1	🟢 100%
📊	BBD readme has shared responsibility table (✅/❌)	1/1	🟢 100%
🚫	No documentation_md output in backplane	1/1	🟢 100%
🔄	meshstack_platform has lifecycle ignore_changes = [availability]	n/a	—

Azure Backplane — some checks failing

Azure UAMI-based automation principal conventions — applies to 1 modules

Module	Score	🪪	🚫	🚫	🔑	🔗	⚡	🧹	📤	📍
azure/azure-virtual-machine-starterkit	🔴 44%	❌	✅	✅	✅	❌	❌	✅	❌	❌

Azure Backplane — Summary

Emoji	Criterion	Coverage	Status
🪪	Uses azurerm_user_assigned_identity	0/1	🔴 0%
🚫	No azuread_application resources	1/1	🟢 100%
🚫	No azuread_service_principal resources	1/1	🟢 100%
🔑	No azuread_application_password resources	1/1	🟢 100%
🔗	Uses azurerm_federated_identity_credential	0/1	🔴 0%
⚡	workload_identity_federation is non-nullable	0/1	🔴 0%
🧹	No create_service_principal_name toggle	1/1	🟢 100%
📤	Outputs identity (client_id, principal_id, tenant_id)	0/1	🔴 0%
📍	Integration has azure_location	0/1	🔴 0%

STACKIT Backplane — not applicable

STACKIT WIF-based automation principal conventions — applies to 0 modules

No applicable modules.

Testing — some checks failing

End-to-end test coverage — applies to 1 modules

Module	Score	⚙️	🧪	✅
azure/azure-virtual-machine-starterkit	🔴 33%	✅	❌	❌

Testing — Summary

Emoji	Criterion	Coverage	Status
⚙️	backplane/ directory (optional tier)	1/1	🟢 100%
🧪	e2e/ test directory exists	0/1	🔴 0%
✅	e2e/ contains .tftest.hcl files	0/1	🔴 0%

[aws-amplify-eu-central-1]

This pull request is automatically being deployed by Amplify Hosting (learn more).

Access this pull request here: https://pr-220.d1o16zfeoh2slu.amplifyapp.com