Fix critical BCP420 scope resolution error and safe access warnings

Co-authored-by: spboyer <[email protected]>

Author: Copilot

infra/core/ai/cognitiveservices.bicep

@@ -44,9 +44,9 @@ resource deployment 'Microsoft.CognitiveServices/accounts/deployments@2023-05-01
   name: deployment.name
   properties: {
     model: deployment.model
-    raiPolicyName: contains(deployment, 'raiPolicyName') ? deployment.raiPolicyName : null
+    raiPolicyName: deployment.?raiPolicyName ?? null
   }
-  sku: contains(deployment, 'sku') ? deployment.sku : {
+  sku: deployment.?sku ?? {
     name: 'Standard'
     capacity: 20
   }

infra/core/host/container-apps.bicep

@@ -21,9 +21,19 @@ module containerAppsEnvironment 'container-apps-environment.bicep' = {
   }
 }
 
-module containerRegistry 'container-registry.bicep' = {
+module containerRegistryInCustomRG 'container-registry.bicep' = if (!empty(containerRegistryResourceGroupName)) {
+  name: '${name}-container-registry'
+  scope: resourceGroup(containerRegistryResourceGroupName)
+  params: {
+    name: containerRegistryName
+    location: location
+    adminUserEnabled: containerRegistryAdminUserEnabled
+    tags: tags
+  }
+}
+
+module containerRegistryInCurrentRG 'container-registry.bicep' = if (empty(containerRegistryResourceGroupName)) {
   name: '${name}-container-registry'
-  scope: !empty(containerRegistryResourceGroupName) ? resourceGroup(containerRegistryResourceGroupName) : resourceGroup()
   params: {
     name: containerRegistryName
     location: location
@@ -36,5 +46,5 @@ output defaultDomain string = containerAppsEnvironment.outputs.defaultDomain
 output environmentName string = containerAppsEnvironment.outputs.name
 output environmentId string = containerAppsEnvironment.outputs.id
 
-output registryLoginServer string = containerRegistry.outputs.loginServer
-output registryName string = containerRegistry.outputs.name
+output registryLoginServer string = !empty(containerRegistryResourceGroupName) ? containerRegistryInCustomRG.outputs.loginServer : containerRegistryInCurrentRG.outputs.loginServer
+output registryName string = !empty(containerRegistryResourceGroupName) ? containerRegistryInCustomRG.outputs.name : containerRegistryInCurrentRG.outputs.name

infra/core/security/keyvault-secrets.bicep

@@ -13,11 +13,11 @@ resource keyVaultSecret 'Microsoft.KeyVault/vaults/secrets@2022-07-01' = [for se
   tags: tags
   properties: {
     attributes: {
-      enabled: contains(secret, 'enabled') ? secret.enabled : true
-      exp: contains(secret, 'exp') ? secret.exp : 0
-      nbf: contains(secret, 'nbf') ? secret.nbf : 0
+      enabled: secret.?enabled ?? true
+      exp: secret.?exp ?? 0
+      nbf: secret.?nbf ?? 0
     }
-    contentType: contains(secret, 'contentType') ? secret.contentType : 'string'
+    contentType: secret.?contentType ?? 'string'
     value: secret.value
   }
 }]

infra/core/storage/storage-account.bicep

@@ -62,7 +62,7 @@ resource storage 'Microsoft.Storage/storageAccounts@2023-01-01' = {
     resource container 'containers' = [for container in containers: {
       name: container.name
       properties: {
-        publicAccess: contains(container, 'publicAccess') ? container.publicAccess : 'None'
+        publicAccess: container.?publicAccess ?? 'None'
       }
     }]
   }