Merge branch 'main' into MJ

Author: bfirstandrich

.azdo/pipelines/azure-dev.yml

@@ -0,0 +1,136 @@
+# Run when commits are pushed to mainline branch (main or master)
+# Set this to the mainline branch you are using
+trigger:
+  - main
+  - master
+
+# Azure Pipelines workflow to deploy to Azure using azd
+# To configure required secrets and service connection for connecting to Azure, simply run `azd pipeline config --provider azdo`
+# Task "Install azd" needs to install setup-azd extension for azdo - https://marketplace.visualstudio.com/items?itemName=ms-azuretools.azd
+# See below for alternative task to install azd if you can't install above task in your organization
+
+pool:
+  vmImage: ubuntu-latest
+
+steps:
+  - task: setup-azd@0
+    displayName: Install azd
+
+  # If you can't install above task in your organization, you can comment it and uncomment below task to install azd
+  # - task: Bash@3
+  #   displayName: Install azd
+  #   inputs:
+  #     targetType: 'inline'
+  #     script: |
+  #       curl -fsSL https://aka.ms/install-azd.sh | bash
+
+  # azd delegate auth to az to use service connection with AzureCLI@2
+  - pwsh: |
+      azd config set auth.useAzCliAuth "true"
+    displayName: Configure AZD to Use AZ CLI Authentication.
+
+  - task: AzureCLI@2
+    displayName: Provision Infrastructure
+    inputs:
+      # azconnection is the service connection created by azd. You can change it to any service connection you have in your organization.
+      azureSubscription: azconnection
+      scriptType: bash
+      scriptLocation: inlineScript
+      inlineScript: |
+        azd provision --no-prompt
+    env:
+      AZURE_SUBSCRIPTION_ID: $(AZURE_SUBSCRIPTION_ID)
+      AZURE_ENV_NAME: $(AZURE_ENV_NAME)
+      AZURE_LOCATION: $(AZURE_LOCATION)
+      AZD_INITIAL_ENVIRONMENT_CONFIG: $(AZD_INITIAL_ENVIRONMENT_CONFIG)
+      AZURE_OPENAI_SERVICE: $(AZURE_OPENAI_SERVICE)
+      AZURE_OPENAI_API_VERSION: $(AZURE_OPENAI_API_VERSION)
+      AZURE_OPENAI_LOCATION: $(AZURE_OPENAI_LOCATION)
+      AZURE_OPENAI_RESOURCE_GROUP: $(AZURE_OPENAI_RESOURCE_GROUP)
+      AZURE_DOCUMENTINTELLIGENCE_SERVICE: $(AZURE_DOCUMENTINTELLIGENCE_SERVICE)
+      AZURE_DOCUMENTINTELLIGENCE_RESOURCE_GROUP: $(AZURE_DOCUMENTINTELLIGENCE_RESOURCE_GROUP)
+      AZURE_DOCUMENTINTELLIGENCE_SKU: $(AZURE_DOCUMENTINTELLIGENCE_SKU)
+      AZURE_DOCUMENTINTELLIGENCE_LOCATION: $(AZURE_DOCUMENTINTELLIGENCE_LOCATION)
+      AZURE_SEARCH_INDEX: $(AZURE_SEARCH_INDEX)
+      AZURE_SEARCH_SERVICE: $(AZURE_SEARCH_SERVICE)
+      AZURE_SEARCH_SERVICE_RESOURCE_GROUP: $(AZURE_SEARCH_SERVICE_RESOURCE_GROUP)
+      AZURE_SEARCH_SERVICE_LOCATION: $(AZURE_SEARCH_SERVICE_LOCATION)
+      AZURE_SEARCH_SERVICE_SKU: $(AZURE_SEARCH_SERVICE_SKU)
+      AZURE_SEARCH_QUERY_LANGUAGE: $(AZURE_SEARCH_QUERY_LANGUAGE)
+      AZURE_SEARCH_QUERY_SPELLER: $(AZURE_SEARCH_QUERY_SPELLER)
+      AZURE_SEARCH_SEMANTIC_RANKER: $(AZURE_SEARCH_SEMANTIC_RANKER)
+      AZURE_SEARCH_QUERY_REWRITING: $(AZURE_SEARCH_QUERY_REWRITING)
+      AZURE_SEARCH_FIELD_NAME_EMBEDDING: $(AZURE_SEARCH_FIELD_NAME_EMBEDDING)
+      AZURE_STORAGE_ACCOUNT: $(AZURE_STORAGE_ACCOUNT)
+      AZURE_STORAGE_RESOURCE_GROUP: $(AZURE_STORAGE_RESOURCE_GROUP)
+      AZURE_STORAGE_SKU: $(AZURE_STORAGE_SKU)
+      AZURE_APP_SERVICE_SKU: $(AZURE_APP_SERVICE_SKU)
+      AZURE_OPENAI_CHATGPT_MODEL: $(AZURE_OPENAI_CHATGPT_MODEL)
+      AZURE_OPENAI_CHATGPT_DEPLOYMENT: $(AZURE_OPENAI_CHATGPT_DEPLOYMENT)
+      AZURE_OPENAI_CHATGPT_DEPLOYMENT_CAPACITY: $(AZURE_OPENAI_CHATGPT_DEPLOYMENT_CAPACITY)
+      AZURE_OPENAI_CHATGPT_DEPLOYMENT_VERSION: $(AZURE_OPENAI_CHATGPT_DEPLOYMENT_VERSION)
+      AZURE_OPENAI_CHATGPT_DEPLOYMENT_SKU: $(AZURE_OPENAI_CHATGPT_DEPLOYMENT_SKU)
+      AZURE_OPENAI_REASONING_EFFORT: $(AZURE_OPENAI_REASONING_EFFORT)
+      AZURE_OPENAI_EMB_MODEL_NAME: $(AZURE_OPENAI_EMB_MODEL_NAME)
+      AZURE_OPENAI_EMB_DEPLOYMENT: $(AZURE_OPENAI_EMB_DEPLOYMENT)
+      AZURE_OPENAI_EMB_DEPLOYMENT_CAPACITY: $(AZURE_OPENAI_EMB_DEPLOYMENT_CAPACITY)
+      AZURE_OPENAI_EMB_DEPLOYMENT_VERSION: $(AZURE_OPENAI_EMB_DEPLOYMENT_VERSION)
+      AZURE_OPENAI_EMB_DEPLOYMENT_SKU: $(AZURE_OPENAI_EMB_DEPLOYMENT_SKU)
+      AZURE_OPENAI_EMB_DIMENSIONS: $(AZURE_OPENAI_EMB_DIMENSIONS)
+      AZURE_OPENAI_GPT4V_MODEL: $(AZURE_OPENAI_GPT4V_MODEL)
+      AZURE_OPENAI_GPT4V_DEPLOYMENT: $(AZURE_OPENAI_GPT4V_DEPLOYMENT)
+      AZURE_OPENAI_GPT4V_DEPLOYMENT_CAPACITY: $(AZURE_OPENAI_GPT4V_DEPLOYMENT_CAPACITY)
+      AZURE_OPENAI_GPT4V_DEPLOYMENT_VERSION: $(AZURE_OPENAI_GPT4V_DEPLOYMENT_VERSION)
+      AZURE_OPENAI_GPT4V_DEPLOYMENT_SKU: $(AZURE_OPENAI_GPT4V_DEPLOYMENT_SKU)
+      AZURE_OPENAI_DISABLE_KEYS: $(AZURE_OPENAI_DISABLE_KEYS)
+      OPENAI_HOST: $(OPENAI_HOST)
+      OPENAI_API_KEY: $(OPENAI_API_KEY)
+      OPENAI_ORGANIZATION: $(OPENAI_ORGANIZATION)
+      AZURE_USE_APPLICATION_INSIGHTS: $(AZURE_USE_APPLICATION_INSIGHTS)
+      AZURE_APPLICATION_INSIGHTS: $(AZURE_APPLICATION_INSIGHTS)
+      AZURE_APPLICATION_INSIGHTS_DASHBOARD: $(AZURE_APPLICATION_INSIGHTS_DASHBOARD)
+      AZURE_LOG_ANALYTICS: $(AZURE_LOG_ANALYTICS)
+      USE_VECTORS: $(USE_VECTORS)
+      USE_GPT4V: $(USE_GPT4V)
+      AZURE_VISION_ENDPOINT: $(AZURE_VISION_ENDPOINT)
+      VISION_SECRET_NAME: $(VISION_SECRET_NAME)
+      AZURE_COMPUTER_VISION_SERVICE: $(AZURE_COMPUTER_VISION_SERVICE)
+      AZURE_COMPUTER_VISION_RESOURCE_GROUP: $(AZURE_COMPUTER_VISION_RESOURCE_GROUP)
+      AZURE_COMPUTER_VISION_LOCATION: $(AZURE_COMPUTER_VISION_LOCATION)
+      AZURE_COMPUTER_VISION_SKU: $(AZURE_COMPUTER_VISION_SKU)
+      ENABLE_LANGUAGE_PICKER: $(ENABLE_LANGUAGE_PICKER)
+      USE_SPEECH_INPUT_BROWSER: $(USE_SPEECH_INPUT_BROWSER)
+      USE_SPEECH_OUTPUT_BROWSER: $(USE_SPEECH_OUTPUT_BROWSER)
+      USE_SPEECH_OUTPUT_AZURE: $(USE_SPEECH_OUTPUT_AZURE)
+      AZURE_SPEECH_SERVICE: $(AZURE_SPEECH_SERVICE)
+      AZURE_SPEECH_SERVICE_RESOURCE_GROUP: $(AZURE_SPEECH_SERVICE_RESOURCE_GROUP)
+      AZURE_SPEECH_SERVICE_LOCATION: $(AZURE_SPEECH_SERVICE_LOCATION)
+      AZURE_SPEECH_SERVICE_SKU: $(AZURE_SPEECH_SERVICE_SKU)
+      AZURE_SPEECH_SERVICE_VOICE: $(AZURE_SPEECH_SERVICE_VOICE)
+      AZURE_KEY_VAULT_NAME: $(AZURE_KEY_VAULT_NAME)
+      AZURE_USE_AUTHENTICATION: $(AZURE_USE_AUTHENTICATION)
+      AZURE_ENFORCE_ACCESS_CONTROL: $(AZURE_ENFORCE_ACCESS_CONTROL)
+      AZURE_ENABLE_GLOBAL_DOCUMENT_ACCESS: $(AZURE_ENABLE_GLOBAL_DOCUMENT_ACCESS)
+      AZURE_ENABLE_UNAUTHENTICATED_ACCESS: $(AZURE_ENABLE_UNAUTHENTICATED_ACCESS)
+      AZURE_TENANT_ID: $(AZURE_TENANT_ID)
+      AZURE_AUTH_TENANT_ID: $(AZURE_AUTH_TENANT_ID)
+      AZURE_SERVER_APP_ID: $(AZURE_SERVER_APP_ID)
+      AZURE_CLIENT_APP_ID: $(AZURE_CLIENT_APP_ID)
+      ALLOWED_ORIGIN: $(ALLOWED_ORIGIN)
+      AZURE_SERVER_APP_SECRET: $(AZURE_SERVER_APP_SECRET)
+      AZURE_CLIENT_APP_SECRET: $(AZURE_CLIENT_APP_SECRET)
+      AZURE_ADLS_GEN2_STORAGE_ACCOUNT: $(AZURE_ADLS_GEN2_STORAGE_ACCOUNT)
+      AZURE_ADLS_GEN2_FILESYSTEM_PATH: $(AZURE_ADLS_GEN2_FILESYSTEM_PATH)
+      AZURE_ADLS_GEN2_FILESYSTEM: $(AZURE_ADLS_GEN2_FILESYSTEM)
+      DEPLOYMENT_TARGET: $(DEPLOYMENT_TARGET)
+      AZURE_CONTAINER_APPS_WORKLOAD_PROFILE: $(AZURE_CONTAINER_APPS_WORKLOAD_PROFILE)
+      USE_CHAT_HISTORY_BROWSER: $(USE_CHAT_HISTORY_BROWSER)
+      USE_MEDIA_DESCRIBER_AZURE_CU: $(USE_MEDIA_DESCRIBER_AZURE_CU)
+  - task: AzureCLI@2
+    displayName: Deploy Application
+    inputs:
+      azureSubscription: azconnection
+      scriptType: bash
+      scriptLocation: inlineScript
+      inlineScript: |
+        azd deploy --no-prompt

.devcontainer/devcontainer.json

@@ -3,11 +3,12 @@
     "image": "mcr.microsoft.com/devcontainers/python:3.11",
     "features": {
         "ghcr.io/devcontainers/features/node:1": {
-            "version": "16",
+            // This should match the version of Node.js in Github Actions workflows
+            "version": "22",
             "nodeGypDependencies": false
         },
-        "ghcr.io/devcontainers/features/powershell:1.1.0": {},
-        "ghcr.io/devcontainers/features/azure-cli:1.0.8": {},
+        "ghcr.io/devcontainers/features/azure-cli:1.2.5": {},
+        "ghcr.io/devcontainers/features/docker-in-docker:2": {},
         "ghcr.io/azure/azure-dev/azd:latest": {}
     },
     "customizations": {

.github/PULL_REQUEST_TEMPLATE.md

@@ -1,18 +1,31 @@
 ## Purpose
+
 <!-- Describe the intention of the changes being proposed. What problem does it solve or functionality does it add? -->
-* ...
+
 
 ## Does this introduce a breaking change?
-<!-- Mark one with an "x". -->
+
+When developers merge from main and run the server, azd up, or azd deploy, will this produce an error?
+If you're not sure, try it out on an old environment.
+
 ```
 [ ] Yes
 [ ] No
 ```
 
-## Pull Request Type
-What kind of change does this Pull Request introduce?
+## Does this require changes to learn.microsoft.com docs?
+
+This repository is referenced by [this tutorial](https://learn.microsoft.com/azure/developer/python/get-started-app-chat-template)
+which includes deployment, settings and usage instructions. If text or screenshot need to change in the tutorial,
+check the box below and notify the tutorial author. A Microsoft employee can do this for you if you're an external contributor.
+
+```
+[ ] Yes
+[ ] No
+```
+
+## Type of change
 
-<!-- Please check the one that applies to this PR using "x". -->
 ```
 [ ] Bugfix
 [ ] Feature
@@ -22,24 +35,12 @@ What kind of change does this Pull Request introduce?
 [ ] Other... Please describe:
 ```
 
-## How to Test
-*  Get the code
-
-```
-git clone [repo-address]
-cd [repo-name]
-git checkout [branch-name]
-npm install
-```
-
-* Test the code
-<!-- Add steps to run the tests suite and/or manually test -->
-```
-```
+## Code quality checklist
 
-## What to Check
-Verify that the following are valid
-* ...
+See [CONTRIBUTING.md](https://github.com/Azure-Samples/azure-search-openai-demo/blob/main/CONTRIBUTING.md#submit-pr) for more details.
 
-## Other Information
-<!-- Add any other helpful information that may be needed here. -->
+- [ ] The current tests all pass (`python -m pytest`).
+- [ ] I added tests that prove my fix is effective or that my feature works
+- [ ] I ran `python -m pytest --cov` to verify 100% coverage of added lines
+- [ ] I ran `python -m mypy` to check for type errors
+- [ ] I either used the pre-commit hooks or ran `ruff` and `black` manually on my code.

.github/dependabot.yaml

@@ -16,19 +16,9 @@ updates:
     directory: "/app/frontend"
     schedule:
       interval: "weekly"
-    groups:
-      node-packages:
-        patterns:
-          - "*"
 
   # Maintain dependencies for pip
   - package-ecosystem: "pip"
     directory: "/"
     schedule:
       interval: "weekly"
-    groups:
-      python-requirements:
-        patterns:
-          - "*"
-    ignore:
-      - dependency-name: azure-search-documents

.github/workflows/azure-dev-validation.yaml

@@ -8,29 +8,49 @@ on:
     branches: [ main ]
     paths:
       - "infra/**"
+  workflow_dispatch:
 
 jobs:
-  build:
-
+  bicep:
     runs-on: ubuntu-latest
+    permissions:
+      security-events: write
     steps:
       - name: Checkout
         uses: actions/checkout@v4
 
       - name: Build Bicep for linting
-        uses: azure/CLI@v1
+        uses: azure/CLI@v2
         with:
-          inlineScript: az config set bicep.use_binary_from_path=false && az bicep build -f infra/main.bicep --stdout
-          
-      - name: Run Microsoft Security DevOps Analysis
-        uses: microsoft/security-devops-action@preview
-        id: msdo
-        continue-on-error: true
+          inlineScript: |
+            export DOTNET_SYSTEM_GLOBALIZATION_INVARIANT=1
+            az config set bicep.use_binary_from_path=false && az bicep build -f infra/main.bicep --stdout
+
+  psrule:
+    runs-on: ubuntu-latest
+    permissions:
+      security-events: write
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Run PSRule analysis
+        uses: microsoft/[email protected]
         with:
-          tools: templateanalyzer
+          modules: PSRule.Rules.Azure
+          baseline: Azure.Pillar.Security
+          inputPath: infra/*.test.bicep
+          outputFormat: Sarif
+          outputPath: reports/ps-rule-results.sarif
+          summary: true
+        continue-on-error: true
+
+        env:
+          PSRULE_CONFIGURATION_AZURE_BICEP_FILE_EXPANSION: 'true'
+          PSRULE_CONFIGURATION_AZURE_BICEP_FILE_EXPANSION_TIMEOUT: '30'
 
-      - name: Upload alerts to Security tab
+      - name: Upload results to security tab
         uses: github/codeql-action/upload-sarif@v3
         if: github.repository == 'Azure-Samples/azure-search-openai-demo'
         with:
-          sarif_file: ${{ steps.msdo.outputs.sarifFile }}
+          sarif_file: reports/ps-rule-results.sarif