Azure deployment

Pipeline ownership

GitHub Actions is the supported CI/CD runner. The repository contains many entry points and reusable modules; these are the principal deployment lanes:

Workflow	Current role
.github/workflows/code-promote.yml	Staged primary orchestrator for supported testing requests and K12/TAP/SDAC dev. Runs plan/preflight, build/environment, manifest, deploy, configure, validate, and finalize stages.
.github/workflows/code-promote-legacy.yml	Legacy monolith, scheduled maintenance lane, and router fallback while staged rollout continues.
.github/workflows/deploy-to-testing.yml	Branch/SHA deployment entry point for the shared testing environment; routes image-only changes to fast deployment and broader impact through promotion.
.github/workflows/fast-code-deploy.yml	Reuses immutable manifest-backed images; it does not own DB, infrastructure, APIM, or settings changes.
.github/workflows/environment-reconcile.yml	Grants, APIM, settings, validation, and smoke reconciliation.
.github/workflows/env-bootstrap.yml	New-environment infrastructure/bootstrap path. Its direct legacy promotion dispatch is a known compatibility gap, not a pattern to copy.
.github/workflows/deploy-model-runtime.yml	Deploys Azure AI model capacity and can seed runtime model tables.
.github/workflows/prod-slot-swap.yml	Explicit production slot promotion/rollback surface.

code-promote-collapsed.yml no longer exists. Historical references describe the design that was absorbed into code-promote.yml.

Dispatch safety

Do not hand-write gh workflow run commands for Code Promote. Resolve and validate the route locally:

node scripts/github-actions/prepare-code-promote-dispatch.mjs \
  --project testing \
  --deploy-target test \
  --source-commit HEAD

Run only the emitted command after the result reports "ok": true, and use its workflowFile rather than assuming primary or legacy ownership.

For design/review work, render and validate a local plan without dispatching:

node scripts/github-actions/render-code-promotion-plan.mjs \
  --project testing --deploy-target test --source-commit HEAD

node scripts/github-actions/validate-code-promotion-plan.mjs \
  --project testing --deploy-target test --source-commit HEAD

These commands do not deploy Azure resources.

Build and deploy contract

1. Resolve the project/environment/component contract from project config, environment declaration, and deployment profile.
2. Build selected package exports, runtime bundles, images, DACPAC, docs, and other requested artifacts.
3. Publish images to ACR and materialize an immutable promotion manifest.
4. Apply environment/database changes when selected.
5. Deploy the selected services and synchronize runtime settings.
6. Reconcile model/profile/APIM state and validate health/contracts.
7. Publish final evidence. Production cutover remains a separately approved slot operation where the environment contract uses slots.

Identity and configuration

GitHub environments provide OIDC values such as AZURE_CLIENT_ID, AZURE_TENANT_ID, and AZURE_SUBSCRIPTION_ID. Environment-specific runtime settings come from the resolved contract and Key Vault; do not copy backend .env files into browser workbenches.

Repository implementation does not prove that GitHub environment protection, runner labels, Azure roles, optional variables, schedules, or a rollout are active. Verify live state separately before operating an environment.

Local validation

For workflow/config changes, run the targeted tests/infra/** suite and the specific planner/validator required by the root AGENTS.md. The broad promotion contract gate is:

bash scripts/github-actions/validate-code-promotion-contract.sh

See Deployment and operations for the lane decision map and Database deployment for DACPAC safety.