feat: Enhance deployment automation and Bicep CLI prerequisites

[Tejasri-Microsoft]

This pull request refactors the deployment and post-deployment workflow for the Content Processing Solution Accelerator, making post-deployment steps more modular, manual, and idempotent. It removes automatic post-provision hooks from the deployment YAMLs, updates documentation to reflect the new manual script-based approach, and improves the clarity and flexibility of post-deployment scripts. The changes aim to give users more control, clearer guidance, and easier troubleshooting for schema registration, sample data upload, and authentication setup.

Deployment and Post-Deployment Workflow Refactor:

• Removed automatic post-provision hooks from azure.yaml and azure_custom.yaml, so schema registration, sample data upload, and authentication setup are now performed via explicit manual scripts after deployment. [1] [2]
• Updated infra/scripts/post_deployment.ps1 to support a new POST_DEPLOYMENT_MODE environment variable, allowing users to run schema registration and sample data upload independently or together. Improved output formatting and added logic to resolve existing schemas and schema sets when running in sample-data mode. [1] [2] [3] [4] [5]

Documentation Updates:

• Updated all deployment and post-deployment documentation (README.md, DeploymentGuide.md, AVMPostDeploymentGuide.md, CustomizeSchemaData.md, ConfigureAppAuthentication.md) to instruct users to run manual scripts for schema registration, sample data upload, and authentication. Clarified that these steps are now manual and idempotent, and provided detailed instructions for both Windows and macOS/Linux. [1] [2] [3] [4] [5] [6] [7]

Infrastructure and Requirements:

• Added Bicep CLI (v0.33.0+) as a required tool in documentation, reflecting the need for manual template compilation. [1] [2]

Minor Fixes:

• Fixed a typo in the infra/main.bicep file for the APP_WEB_AUTHORITY environment variable to correct the URL concatenation.

---

Most important changes:

1. Deployment workflow and script improvements

• Removed automatic post-provision hooks from azure.yaml and azure_custom.yaml; all post-deployment steps are now manual and script-driven. [1] [2]
• Enhanced infra/scripts/post_deployment.ps1 to support modular execution (schema registration and sample data upload separately), improved output, and idempotency. [1] [2] [3] [4] [5]

2. Documentation and guidance updates

• Updated all relevant documentation to reflect the new manual post-deployment process, including step-by-step instructions for running scripts and configuring authentication. [1] [2] [3] [4] [5] [6] [7]

3. Infrastructure requirements

• Added Bicep CLI as a required tool in documentation for infrastructure template compilation. [1] [2]

4. Minor bug fix

• Fixed the APP_WEB_AUTHORITY value in infra/main.bicep to correctly concatenate the login endpoint and tenant ID.## Purpose

• ...

Does this introduce a breaking change?

• Yes
• [ x] No

Golden Path Validation

• [ x] I have tested the primary workflows (the "golden path") to ensure they function correctly without errors.

Deployment Validation

• [x ] I have validated the deployment process successfully and all services are running as expected with this change.

What to Check

Verify that the following are valid

• ...

Other Information

[Copilot]

Pull request overview

This PR refactors the solution’s deployment workflow to remove automatic post-provision actions and instead provide explicit, script-driven post-deployment steps (schema registration, sample data upload, and Entra ID auth setup), along with updated documentation and new helper/testing scripts.

Changes:

• Removed azd postprovision hooks so post-deployment actions are run manually via scripts.
• Split/organized post-deployment into discrete scripts (schema registration, sample data upload, auth setup) and added preflight testing for auth setup.
• Updated docs and fixed an APP_WEB_AUTHORITY concatenation issue in the Bicep template.

Reviewed changes

Copilot reviewed 24 out of 24 changed files in this pull request and generated 17 comments.

Show a summary per file

File	Description
src/ContentProcessorAPI/samples/claim_hail/bundle_info.json	Adds bundle manifest mapping sample files to schema classes.
src/ContentProcessorAPI/samples/claim_date_of_loss/bundle_info.json	Adds bundle manifest mapping sample files to schema classes.
README.md	Documents Bicep CLI prerequisite and new manual post-deployment requirement.
infra/scripts/upload_sample_data.sh	Adds POSIX wrapper to run post-deployment in sample-data mode.
infra/scripts/upload_sample_data.ps1	Adds PowerShell wrapper to run post-deployment in sample-data mode.
infra/scripts/test_configure_auth_preflight.sh	Adds bash-based mocked tests for configure_auth.sh --preflight-only.
infra/scripts/test_configure_auth_preflight.ps1	Adds PowerShell-based mocked tests for configure_auth.ps1 --preflight-only.
infra/scripts/setup_auth.sh	Adds POSIX wrapper to run auth configuration script.
infra/scripts/setup_auth.ps1	Adds PowerShell wrapper to run auth configuration script.
infra/scripts/run_post_deployment.sh	Adds orchestrator script to run schema registration, sample upload, and auth setup with skip flags.
infra/scripts/run_post_deployment.ps1	Adds orchestrator script to run schema registration, sample upload, and auth setup with skip flags.
infra/scripts/register_schemas.sh	Adds POSIX wrapper to run post-deployment in schema-only mode.
infra/scripts/register_schemas.ps1	Adds PowerShell wrapper to run post-deployment in schema-only mode.
infra/scripts/post_deployment.sh	Adds POST_DEPLOYMENT_MODE behavior and logic to resolve/upload sample bundles.
infra/scripts/post_deployment.ps1	Adds POST_DEPLOYMENT_MODE behavior and logic to resolve/upload sample bundles.
infra/scripts/configure_auth.sh	Adds idempotent Entra app registration + EasyAuth automation with preflight checks.
infra/scripts/configure_auth.ps1	Adds idempotent Entra app registration + EasyAuth automation with preflight checks.
infra/main.bicep	Fixes APP_WEB_AUTHORITY value concatenation.
docs/DeploymentGuide.md	Updates guide to reflect manual post-deployment scripts and Bicep prerequisite.
docs/CustomizeSchemaData.md	Updates links and notes related to schema registration workflow.
docs/ConfigureAppAuthentication.md	Adds “recommended script-first” guidance for auth setup.
docs/AVMPostDeploymentGuide.md	Updates AVM post-deployment guidance to include sample processing and manual steps.
azure.yaml	Removes automatic postprovision hook.
azure_custom.yaml	Removes automatic postprovision hook.

Comments suppressed due to low confidence (5)

infra/scripts/run_post_deployment.sh:120

• This sed -i usage will fail on macOS (BSD sed requires -i ''). Because this script targets macOS/Linux, consider using an OS-conditional in-place edit or a portable line-ending normalization method.

  if [[ ! -f "$STEP2_SCRIPT" ]]; then
    echo "  ❌ Script not found: $STEP2_SCRIPT" >&2
    exit 1
  fi

  sed -i 's/\r$//' "$STEP2_SCRIPT"
  chmod +x "$STEP2_SCRIPT"

infra/scripts/run_post_deployment.sh:167

• This sed -i usage will fail on macOS (BSD sed requires -i ''). Because this script targets macOS/Linux, consider using an OS-conditional in-place edit or a portable line-ending normalization method.

  if [[ ! -f "$STEP3_SCRIPT" ]]; then
    echo "  ❌ Script not found: $STEP3_SCRIPT" >&2
    exit 1
  fi

  sed -i 's/\r$//' "$STEP3_SCRIPT"
  chmod +x "$STEP3_SCRIPT"

docs/DeploymentGuide.md:351

• The macOS/Linux instructions use sed -i without a backup suffix, which will fail on macOS (BSD sed). Please adjust the docs to a portable command (e.g., sed -i '' on macOS) or provide an OS-conditional snippet.

**macOS/Linux:**

```bash
sed -i 's/\r$//' ./infra/scripts/upload_sample_data.sh
bash ./infra/scripts/upload_sample_data.sh

docs/DeploymentGuide.md:369

• The macOS/Linux instructions use sed -i without a backup suffix, which will fail on macOS (BSD sed). Please adjust the docs to a portable command (e.g., sed -i '' on macOS) or provide an OS-conditional snippet.

```bash
sed -i 's/\r$//' ./infra/scripts/setup_auth.sh
bash ./infra/scripts/setup_auth.sh

**infra/scripts/configure_auth.sh:369**
* `/proc/sys/kernel/random/uuid` is Linux-specific and will fail on macOS. Since this script is intended for macOS/Linux, use a portable UUID source (e.g., `uuidgen`, or `python -c 'import uuid; print(uuid.uuid4())'`).

WEB_SCOPE_ID="$(az ad app show --id "$WEB_CLIENT_ID"
--query "api.oauth2PermissionScopes[?value=='user_impersonation'].id | [0]" -o tsv)"
[[ -z "$WEB_SCOPE_ID" || "$WEB_SCOPE_ID" == "null" ]] && WEB_SCOPE_ID="$(cat /proc/sys/kernel/random/uuid)"

</details>



---

💡 <a href="/microsoft/content-processing-solution-accelerator/new/dev?filename=.github/instructions/*.instructions.md" class="Link--inTextBlock" target="_blank" rel="noopener noreferrer">Add Copilot custom instructions</a> for smarter, more guided reviews. <a href="https://docs.github.com/en/copilot/customizing-copilot/adding-repository-custom-instructions-for-github-copilot" class="Link--inTextBlock" target="_blank" rel="noopener noreferrer">Learn how to get started</a>.

[Copilot]

Pull request overview

Copilot reviewed 24 out of 24 changed files in this pull request and generated 7 comments.

Comments suppressed due to low confidence (1)

infra/scripts/test_configure_auth_preflight.ps1:159

• Hard-coding pwsh here makes the test runner fail on systems that only have Windows PowerShell (powershell) available (despite #Requires -Version 5.1). Consider invoking & $Subject directly (current host), or selecting pwsh vs powershell based on availability.

    $origPath = $env:PATH
    $env:PATH  = "$TempDir;$env:PATH"
    $env:AZ_MOCK_SCENARIO  = $AzScenario
    $env:AZD_MOCK_SCENARIO = $AzdScenario
    $env:AZURE_SKIP_AUTH_SETUP = ""

    $rawOutput = pwsh -NoProfile -NonInteractive -ExecutionPolicy Bypass `
        -File $Subject "--preflight-only" 2>&1
    $exitCode = $LASTEXITCODE