fix: Avm post deployment

[Prachig-Microsoft]

Purpose

This PR fixed post deployment script to pass RG as paramter for AVM deployment

Does this introduce a breaking change?

• Yes
• No

Golden Path Validation

• I have tested the primary workflows (the "golden path") to ensure they function correctly without errors.

Deployment Validation

• I have validated the deployment process successfully and all services are running as expected with this change.

What to Check

Verify that the following are valid

• ...

Other Information

[Copilot]

Pull request overview

Updates the post_deployment.ps1 script to support AVM-style deployments by allowing the resource group (and related values) to be provided as parameters, while still supporting existing azd env-based deployments.

Changes:

• Adds parameterized AVM deployment mode (resource group, optional subscription, optional API base URL, optional AI Services account).
• Improves post-deployment robustness with pre-flight checks (network access, ingress port, auth), API readiness polling, and richer diagnostics.
• Refactors schema registration multipart upload to send raw bytes (avoids string re-encoding/corruption).

Suppressed comments (3)

infra/scripts/post_deployment.ps1:92

• az containerapp list ... | ConvertFrom-Json will throw if the Azure CLI command fails or returns an empty string (stderr is suppressed via 2>$null). That prevents the later $ContainerApps.Count -eq 0 check from running and hides the underlying az error.

    # Discover container apps in the resource group
    Write-Host "[Info] Discovering container apps in resource group..."
    $ContainerApps = @(az containerapp list -g $RESOURCE_GROUP --query "[].{name:name, fqdn:properties.configuration.ingress.fqdn}" -o json 2>$null | ConvertFrom-Json)

infra/scripts/post_deployment.ps1:145

• In AZD mode $ApiBaseUrl is constructed even if CONTAINER_API_APP_FQDN is missing/empty in the azd environment, which will result in requests to https:///schemavault/ and a confusing readiness loop. It’s better to fail fast with a clear error when the env value is not set.

    $SUBSCRIPTION_ID = azd env get-value AZURE_SUBSCRIPTION_ID
    $RESOURCE_GROUP = azd env get-value AZURE_RESOURCE_GROUP

    $ApiBaseUrl = "https://$CONTAINER_API_APP_FQDN"
}

infra/scripts/post_deployment.ps1:320

• The script temporarily relaxes the API container app auth setting, but restoration only happens in the two explicit call sites. If the script terminates early due to an unhandled exception (e.g., schema manifest parse error, missing schema_info.json, Ctrl+C), the original auth setting may not be restored. Consider guaranteeing cleanup via a top-level try { ... } finally { Restore-ApiAuthSetting } or a trap/exit handler once $ApiAuthOriginalAction is set.

        if ($AuthAction -and $AuthAction -ne 'AllowAnonymous') {
            Write-Host "  [Warn] API container app has authentication enabled (unauthenticatedClientAction=$AuthAction)."
            Write-Host "         Temporarily allowing anonymous access for schema registration; original setting will be restored afterwards..."
            az containerapp auth update -g $RESOURCE_GROUP -n $CONTAINER_API_APP_NAME --unauthenticated-client-action AllowAnonymous -o none 2>$null
            $ApiAuthOriginalAction = $AuthAction

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.