Python: Add Foundry-hosted Telegram sample

[Eduard van Valkenburg (eavanvalkenburg)]

Motivation & Context

Agent Framework has Telegram protocol helpers and Foundry Invocations hosting support, but it does not yet have an end-to-end sample showing how to expose a Telegram bot through a Foundry Hosted Agent. This adds a deployable learning sample covering the complete Telegram, API Management, Foundry, Agent Framework, and Telegram Bot API path.

Description & Review Guide

• What are the major changes?
  • Adds a self-contained Foundry Hosted Agent sample with APIM webhook authentication and request adaptation, Cosmos DB conversation history, Key Vault secret storage, rich Telegram input handling, streaming responses, and Application Insights telemetry.
  • Adds Bicep infrastructure and a single deployment script that provisions resources, deploys the hosted agent, assigns managed-identity permissions, verifies the endpoints, and registers the Telegram webhook.
  • Adds sample-local pyproject.toml/uv dependency management, focused tests, deployment documentation, and links from the hosting sample indexes.
• What is the impact of these changes?
  • Users can deploy and study a complete Telegram-to-Foundry Hosted Agent integration without relying on pre-existing Azure resources.
  • Existing hosting behavior and public APIs are unchanged.
• What do you want reviewers to focus on?
  • The APIM-to-Invocations boundary, managed-identity/RBAC setup, streaming Telegram delivery behavior, and the documented security and production limitations.

Related Issue

Fixes #6587

Contribution Checklist

• The code builds clean without any errors or warnings
• All unit tests pass, and I have added new tests where possible
• The PR follows the Contribution Guidelines
• This PR is linked to an issue and there is no other open PR for this issue (see Related Issue above).
• This is not a breaking change. If it is a breaking change, add the breaking change label (or add "[BREAKING]" to the title prefix, before or after any language prefix) — a workflow keeps the label and the title prefix in sync automatically.

[github-actions]

Python Test Coverage Report •

File	Stmts	Miss	Cover	Missing
TOTAL	48227	4484	90%

report-only-changed-files is enabled. No files were changed during this commit :)

Python Unit Test Overview

Tests	Skipped	Failures	Errors	Time
9760	36 💤	0 ❌	0 🔥	2m 17s ⏱️

[Copilot]

Pull request overview

Adds an end-to-end Foundry-hosted Telegram agent sample using APIM, Cosmos DB, Key Vault, and Application Insights.

Changes:

• Implements Telegram request handling and streamed delivery.
• Adds Azure infrastructure and deployment automation.
• Adds tests, evaluation configuration, documentation, and validation integration.

Reviewed changes

Copilot reviewed 21 out of 22 changed files in this pull request and generated 2 comments.

Show a summary per file

File	Description
python/scripts/workspace_poe_tasks.py	Excludes the sample from workspace typing checks.
python/pyrightconfig.samples.json	Adds the sample to Pyright exclusions.
python/samples/04-hosting/README.md	Advertises the Telegram hosted sample.
python/samples/04-hosting/foundry-hosted-agents/README.md	Adds the Invocations sample link.
python/samples/04-hosting/af-hosting/local_telegram/README.md	Cross-links the hosted variant.
telegram/main.py	Implements the hosted Telegram runtime.
telegram/deploy.sh	Provisions, deploys, validates, and registers the webhook.
telegram/azure.yaml	Defines the hosted-agent service.
telegram/pyproject.toml	Declares runtime and development dependencies.
telegram/README.md	Documents deployment, operation, and limitations.
telegram/eval.yaml	Configures hosted-agent evaluation.
telegram/infra/main.bicep	Defines subscription-level deployment.
telegram/infra/resources.bicep	Provisions Azure resources and RBAC.
telegram/infra/telegram-policy.xml	Authenticates and adapts Telegram webhooks.
telegram/tests/test_main.py	Tests runtime and Telegram behavior.
telegram/tests/test_infrastructure.py	Tests deployment configuration.
telegram/.agentignore	Limits hosted deployment contents.
telegram/.gitignore	Ignores local generated files.
telegram/.env.example	Provides local configuration examples.
telegram/.agent_configs/baseline/metadata.yaml	Defines evaluation metadata.
telegram/.agent_configs/baseline/instructions.md	Defines the evaluation baseline.

---

💡 Add a code-review agent skill for context-aware, tailored reviews. Learn more in the docs.

[github-actions]

MAF Automated Review — Iteration 1

Result: Findings reported
Scope: full PR (1 commit(s)): 7670f4a27347
Model: gpt-5.6-sol

Overview

The sample establishes a clear Telegram-to-APIM-to-Foundry flow with strong webhook-secret handling, managed-identity authentication, bounded downloads, token-safe errors, and focused tests for command and streaming behavior. Four residual integration defects affect advertised media handling, durable Cosmos history, webhook-secret rotation, and idempotent RBAC provisioning. The production limitations appropriately disclose retry, deduplication, concurrency, and network-hardening gaps.

Reviewed the supplied pull-request change set across correctness, security/reliability, architecture, and failure behavior.
4 verified findings remained after source verification (4 medium) across 2 files. Details are attached to the affected lines below.

Affected areas: python/samples/04-hosting/foundry-hosted-agents/invocations/telegram/deploy.sh, python/samples/04-hosting/foundry-hosted-agents/invocations/telegram/main.py