feat: cut over Azure CD to Bicep-driven MSA Container Apps deploy

.cursor/rules/script-style.mdc

@@ -1,12 +1,12 @@
 ---
 description: Bash script, CD workflow, and deploy JSON formatting conventions
-globs: scripts/**/*.sh,.github/workflows/ci-v1.yml,.github/workflows/cd-v1.yml,infra/azure/parameters*.json
+globs: scripts/**/*.sh,.github/workflows/ci-v2.yml,.github/workflows/cd-v2.yml,infra/azure/parameters*.json
 alwaysApply: false
 ---
 
 # Script, CI/CD workflow, and deploy JSON style
 
-Reference entrypoint: [`scripts/cd/azure-cd-inject-secrets.sh`](scripts/cd/azure-cd-inject-secrets.sh).
+Reference entrypoint: [`scripts/cd/azure-cd-deploy-bicep.sh`](scripts/cd/azure-cd-deploy-bicep.sh).
 
 ## Bash entrypoints (`scripts/**/*.sh`)
 
@@ -39,8 +39,7 @@ log_step "SECTION NAME IN ALL CAPS"
 | Scripts | Prefix |
 |---------|--------|
 | CD build / wait / migrate / smoke | `[DEPLOY][BUILD]`, `[DEPLOY][IMAGE]`, `[DEPLOY][MIGRATE]`, `[DEPLOY][SMOKE]` |
-| CD deploy / secrets | `[DEPLOY]` |
-| Infra Bicep deploy | `[DEPLOY][INFRA]` |
+| Infra / CD Bicep deploy | `[DEPLOY][INFRA]` |
 | CI tests / harness / versions | `[CI][TEST]`, `[CI][HARNESS]`, `[CI][VERSIONS]`, `[CI][CACHE]` |
 | Dev / local tooling | `[DEV]`, `[DOTNET]`, `[MIGRATE]`, `[TEST]` |
 
@@ -57,7 +56,7 @@ Set `LOG_PREFIX` **before** sourcing `common.sh`.
 
 Keep `#!/bin/sh`, POSIX-only, no bash `common.sh`. English comments, `set -e`, minimal headers.
 
-## CI and CD workflows ([`ci-v1.yml`](.github/workflows/ci-v1.yml), [`cd-v1.yml`](.github/workflows/cd-v1.yml))
+## CI and CD workflows ([`ci-v2.yml`](.github/workflows/ci-v2.yml), [`cd-v2.yml`](.github/workflows/cd-v2.yml))
 
 Shared conventions:
 

.github/workflows/cd-v1.yml → .github/workflows/cd-v2.yml

@@ -25,7 +25,7 @@ jobs:
   deploy:
     name: Deploy to production
     runs-on: ubuntu-latest
-    timeout-minutes: 60
+    timeout-minutes: 90
     environment: prod
 
     if: >
@@ -90,7 +90,7 @@ jobs:
         run: bash scripts/cd/azure-cd-build-push.sh
 
       ############################################
-      # 4. IMAGE PROPAGATION WAIT
+      # 5. IMAGE PROPAGATION WAIT
       ############################################
       - name: Wait for GHCR image propagation
         env:
@@ -99,7 +99,7 @@ jobs:
         run: bash scripts/cd/azure-cd-wait-image.sh
 
       ############################################
-      # 5. AZURE LOGIN
+      # 6. AZURE LOGIN
       ############################################
       - name: Azure login (OIDC)
         uses: azure/login@v3
@@ -109,36 +109,32 @@ jobs:
           subscription-id: ${{ vars.AZURE_SUBSCRIPTION_ID }}
 
       ############################################
-      # 6. SECRETS
+      # 7. BICEP DEPLOY
       ############################################
-      - name: Inject secrets
+      - name: Deploy infrastructure and apps (Bicep)
         env:
           AZURE_RESOURCE_GROUP: ${{ vars.AZURE_RESOURCE_GROUP }}
+          IMAGE_TAG: ${{ steps.meta.outputs.sha }}
+          USE_PLACEHOLDER_IMAGES: "false"
+          POSTGRES_CONNECTION_STRING: ${{ secrets.POSTGRES_CONNECTION_STRING }}
           BLOB_CONNECTION_STRING: ${{ secrets.BLOB_CONNECTION_STRING }}
           JWT_SECRET: ${{ secrets.JWT_SECRET }}
           WORKER_CALLBACK_SECRET: ${{ secrets.WORKER_CALLBACK_SECRET }}
           METRICS_SCRAPE_SECRET: ${{ secrets.METRICS_SCRAPE_SECRET }}
-          POSTGRES_CONNECTION_STRING: ${{ secrets.POSTGRES_CONNECTION_STRING }}
           GRAFANA_ADMIN_PASSWORD: ${{ secrets.GRAFANA_ADMIN_PASSWORD }}
+          GATEWAY_SECRET: ${{ secrets.GATEWAY_SECRET }}
+          INTERNAL_SERVICE_SECRET: ${{ secrets.INTERNAL_SERVICE_SECRET }}
           APPLICATIONINSIGHTS_CONNECTION_STRING: ${{ secrets.APPLICATIONINSIGHTS_CONNECTION_STRING }}
           PLACES_API_KEY: ${{ secrets.PLACES_API_KEY }}
-        run: bash scripts/cd/azure-cd-inject-secrets.sh
-
-      ############################################
-      # 7. DEPLOY IMAGES
-      ############################################
-      - name: Deploy images on container apps
-        env:
-          AZURE_RESOURCE_GROUP: ${{ vars.AZURE_RESOURCE_GROUP }}
-          CONTAINER_REGISTRY: ${{ steps.meta.outputs.registry }}
-          IMAGE_TAG: ${{ steps.meta.outputs.sha }}
+          GHCR_REGISTRY_USERNAME: ${{ secrets.GHCR_REGISTRY_USERNAME }}
+          GHCR_REGISTRY_PASSWORD: ${{ secrets.GHCR_REGISTRY_PASSWORD }}
           JWT_EXPIRY_MINUTES: ${{ vars.JWT_EXPIRY_MINUTES }}
-        run: bash scripts/cd/azure-cd-deploy-image.sh
+        run: bash scripts/cd/azure-cd-deploy-bicep.sh
 
       ############################################
       # 8. MIGRATION
       ############################################
-      - name: Run EF migrate
+      - name: Run EF migrate jobs
         if: github.event_name == 'workflow_run' || inputs.skip_migrate != true
         env:
           AZURE_RESOURCE_GROUP: ${{ vars.AZURE_RESOURCE_GROUP }}

README.md

@@ -123,7 +123,7 @@ Service boundaries and MSA migration plan: [docs/SERVICE_BOUNDARIES.md](docs/SER
 
 * **GitHub Actions**
 
-  * CI on pull requests and pushes to `main` / `develop` — [`.github/workflows/ci-v1.yml`](.github/workflows/ci-v1.yml)
+  * CI on pull requests and pushes to `main` / `develop` — [`.github/workflows/ci-v2.yml`](.github/workflows/ci-v2.yml)
   * Jobs: .NET build, Rust tests, web lint/test/build, service integration tests (Testcontainers), media harness E2E (Compose + Azurite)
   * Local parity: `./scripts/run-all-tests.sh` (integration + harness + Rust + web; add `--skip-harness` for faster runs)
 
@@ -463,7 +463,7 @@ Integration tests and harness E2E both use Docker Compose, but they work differe
 
 Use `scripts/ci/docker-test.sh` or `--profile test` for integration tests. Do **not** use `docker-dotnet.sh` / `sdk` — the `test` service mounts `/var/run/docker.sock` for Testcontainers.
 
-**CI parity:** [`.github/workflows/ci-v1.yml`](.github/workflows/ci-v1.yml).
+**CI parity:** [`.github/workflows/ci-v2.yml`](.github/workflows/ci-v2.yml).
 
 #### Quick start — integration tests only