Environment Configurations
Environment model
The repository does not have one universal dev/staging/prod shape. A deployable environment is the result of four contracts:
| Source | Responsibility |
|---|---|
environments/<project>/<environment>.yml | Resolved APIM/service names, support status, GitHub environment, runtime ACR, swap mode, write guards, workload settings, and observability/query metadata. |
.github/config/projects/<project>.yml | Project promotion selection, supported targets, and workflow behavior. |
azure_template/profiles/<project>.json | Project component toggles and profile-level infrastructure behavior. |
azure_template/environments/<tier>.bicepparam | Tier defaults for dev, test, staging, and prod. |
azure_template/main.bicep combines these inputs. Never update only a profile
or only a project config and assume the deployment contract remains consistent.
Checked-in declarations
| Project | Declarations | Notes |
|---|---|---|
| Shared testing | environments/shared/test.yml | Supported shared target; historical GitHub environment name is azure-tap. External writes are blocked/dry-run guarded. |
| K12 | dev, staging, prod | Currently declared supported. |
| TAP | dev, staging, prod | Currently declared supported; prod uses external/manual swap metadata. |
| SDAC | dev, staging, prod | Runtime declarations exist; inspect each file because older records do not all carry the same support/swap metadata. |
| Handbook | dev, test, staging, prod | Dev is enabled/supported; other declarations include planned or disabled states and must not be described as live. |
| RCV | dev, prod | Declared planned targets. |
A checked-in file is not live-deployment evidence. Before operating a target,
verify enabled, supportStatus, GitHub environment protection, OIDC/RBAC,
resource existence, and health.
Component profiles
| Profile | Notable selected components |
|---|---|
testinfra | Runtime, ingestion web, Widget, Admin UI, Handbook App, docs, and Grafana; main and ingestion Function apps are disabled. |
k12 | Runtime, main Function App, ingestion, Admin UI, internal/external docs, and health aggregator; Widget and Handbook App are disabled. |
tap | Runtime, main Function App, ingestion, Admin UI, and docs; Widget and Handbook App are disabled. |
sdac | Runtime, main Function App, ingestion web, Widget, Admin UI, docs, and health aggregator; ingestion Function App is disabled. |
handbook | Runtime, ingestion web/Function apps, Admin UI, Handbook App, docs, and health aggregator; main Function App and Widget are disabled. |
rcv | Runtime, main and ingestion Function apps, ingestion web, Admin UI, docs, and health aggregator. |
The table summarizes current profile booleans; main.bicep defaults and
environment overrides still participate in the final deployment.
Environment tiers
main.bicep accepts dev, test, staging, and prod. Current tier files
configure networking, SKUs, slots, and security posture, but project/environment
declarations can further specialize the result. Do not publish fixed cost or
slot guarantees based only on the tier name.
Change checklist
When introducing or changing an environment:
- Update the environment declaration, project config, and profile together.
- Validate Bicep parameter support and resource naming/collision behavior.
- Evaluate DB/DACPAC, APIM, identities/RBAC, Key Vault, settings, and every selected app image.
- Run
tests/infra/**and the environment/promotion resolver tests. - Use the bootstrap preflight/what-if for new infrastructure; plan mode must remain non-mutating.
- Dispatch Code Promote only through
prepare-code-promote-dispatch.mjs. - Record live rollout, rollback, and health evidence separately from the repository contract.
See Azure deployment and Template parameters.