Fix/postprovision by sashimono-san · Pull Request #58 · microsoft/healthcare-ai-model-evaluator

sashimono-san · 2026-02-17T09:13:14Z

Small fixes on top of feature/VPNDeployment:

Post-provision assignment of Cosmos' data-plane role
Mapping ROOT_ADMIN_* variables for bicep configuration
Fix deployment instructions

* Initial plan * Add COSMOSDB_ENDPOINT environment variable to README.md Co-authored-by: sashimono-san <185106146+sashimono-san@users.noreply.github.com> --------- Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com> Co-authored-by: sashimono-san <185106146+sashimono-san@users.noreply.github.com>

* Initial plan * Fix Docker build: Add -m flag to useradd in Dockerfiles Co-authored-by: sashimono-san <185106146+sashimono-san@users.noreply.github.com> --------- Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com> Co-authored-by: sashimono-san <185106146+sashimono-san@users.noreply.github.com>

Copilot

Pull request overview

This pull request applies several fixes on top of the feature/VPNDeployment branch, focusing on Cosmos DB role assignment improvements, parameter mapping for admin user bootstrapping, Dockerfile user creation fixes, and deployment documentation updates.

Changes:

Updates Cosmos DB role assignment to use SQL data-plane roles with proper built-in role definition IDs
Adds ROOT_ADMIN_* parameter mappings in main.parameters.json for admin user bootstrapping
Fixes Dockerfile user creation by adding -m flag to useradd commands
Reorganizes and improves deployment documentation structure

Reviewed changes

Copilot reviewed 7 out of 7 changed files in this pull request and generated 5 comments.

Show a summary per file

File	Description
infra/scripts/postprovision.sh	Updates Cosmos DB role assignment to use SQL data-plane built-in Data Contributor role with proper role definition ID format
infra/scripts/postprovision.ps1	Same role assignment updates as bash script, applied to both code paths (existing and new client ID)
infra/main.parameters.json	Adds parameter mappings for ROOT_ADMIN_EMAIL, ROOT_ADMIN_NAME, and ROOT_ADMIN_PASSWORD environment variables
functions/Dockerfile	Adds `-m` flag to useradd command to create home directory automatically
functions/Dockerfile.addon-dev	Same useradd fix as main Dockerfile
README.md	Updates deployment instructions, adds branch-specific initialization guidance, and updates backend setup environment variables
DEPLOYMENT.md	Reorganizes documentation by moving admin user setup section earlier, adds pre-package addon instructions, and improves deployment flow

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Copilot · 2026-02-17T09:19:31Z

infra/scripts/postprovision.sh

+                --resource-group "$RESOURCE_GROUP_NAME" \
+                --principal-id "$PRINCIPAL_ID" \
+                --role-definition-id "${COSMOS_ACCOUNT_ID}/sqlRoleDefinitions/00000000-0000-0000-0000-000000000002" \
+                --scope "$COSMOS_ACCOUNT_ID" \


The --scope parameter should be "/" (root of the Cosmos account) instead of the full Azure resource ID. The Azure CLI expects a relative scope within the Cosmos account, not the full resource ID. This is consistent with the bicep template (infra/modules/cosmos.bicep:124) and the examples in README.md:143 and DEPLOYMENT.md:333 which all use --scope "/". The role assignment may fail or behave unexpectedly with the full resource ID as scope.

Suggested change

--scope "$COSMOS_ACCOUNT_ID" \

--scope "/" \

Copilot · 2026-02-17T09:19:32Z

infra/scripts/postprovision.ps1

+                        --resource-group $resourceGroupName `
+                        --principal-id $principalId `
+                        --role-definition-id "$cosmosAccountId/sqlRoleDefinitions/00000000-0000-0000-0000-000000000002" `
+                        --scope $cosmosAccountId `


The --scope parameter should be "/" (root of the Cosmos account) instead of the full Azure resource ID. The Azure CLI expects a relative scope within the Cosmos account, not the full resource ID. This is consistent with the bicep template (infra/modules/cosmos.bicep:124) and the examples in README.md:143 and DEPLOYMENT.md:333 which all use --scope "/". The role assignment may fail or behave unexpectedly with the full resource ID as scope.

Suggested change

--scope $cosmosAccountId `

--scope "/" `

Copilot · 2026-02-17T09:19:32Z

infra/scripts/postprovision.ps1

+                    --resource-group $resourceGroupName `
+                    --principal-id $principalId `
+                    --role-definition-id "$cosmosAccountId/sqlRoleDefinitions/00000000-0000-0000-0000-000000000002" `
+                    --scope $cosmosAccountId `


The --scope parameter should be "/" (root of the Cosmos account) instead of the full Azure resource ID. The Azure CLI expects a relative scope within the Cosmos account, not the full resource ID. This is consistent with the bicep template (infra/modules/cosmos.bicep:124) and the examples in README.md:143 and DEPLOYMENT.md:333 which all use --scope "/". The role assignment may fail or behave unexpectedly with the full resource ID as scope.

Suggested change

--scope $cosmosAccountId `

--scope "/" `

Copilot · 2026-02-17T09:19:32Z

README.md

+export COSMOSDB_CONNECTION_STRING="Your mongodb connection string"
+export COSMOSDB_ENDPOINT="Your mongodb endpoint"
+
+# For PowerShell
+$env:AZURE_STORAGE_CONNECTION_STRING="Your Storage Account connection string"
+$env:COSMOSDB_CONNECTION_STRING="Your mongodb connection string"
+$env:COSMOSDB_ENDPOINT="Your mongodb endpoint"


The documentation incorrectly refers to "mongodb connection string" and "mongodb endpoint". The system uses Cosmos DB SQL API, not MongoDB API, as confirmed by DEPLOYMENT.md:292 and DEPLOYMENT.md:298. These should reference "Cosmos DB connection string" and "Cosmos DB endpoint" for consistency and accuracy.

Suggested change

export COSMOSDB_CONNECTION_STRING="Your mongodb connection string"

export COSMOSDB_ENDPOINT="Your mongodb endpoint"

# For PowerShell

$env:AZURE_STORAGE_CONNECTION_STRING="Your Storage Account connection string"

$env:COSMOSDB_CONNECTION_STRING="Your mongodb connection string"

$env:COSMOSDB_ENDPOINT="Your mongodb endpoint"

export COSMOSDB_CONNECTION_STRING="Your Cosmos DB connection string"

export COSMOSDB_ENDPOINT="Your Cosmos DB endpoint"

# For PowerShell

$env:AZURE_STORAGE_CONNECTION_STRING="Your Storage Account connection string"

$env:COSMOSDB_CONNECTION_STRING="Your Cosmos DB connection string"

$env:COSMOSDB_ENDPOINT="Your Cosmos DB endpoint"

Copilot · 2026-02-17T09:19:33Z

README.md

 azd up
 ```

+To initialize the project targetting a specific branch, use the `--branch` flag:


Misspelling: "targetting" should be "targeting" (one 't').

Suggested change

To initialize the project targetting a specific branch, use the `--branch` flag:

To initialize the project targeting a specific branch, use the `--branch` flag:

Copilot AI and others added 6 commits February 16, 2026 11:15

Merge branch 'main' into feature/VPNDeployment

43464d2

fix: post provision cosmos data-plane role

1e97b9a

docs: fix deployment instructions

13e980d

fix: map admin env variables for bicep

4108128

sashimono-san requested review from Copilot and vgfitzger-microsoft February 17, 2026 09:13

Copilot started reviewing on behalf of sashimono-san February 17, 2026 09:13 View session

sashimono-san mentioned this pull request Feb 17, 2026

Feature/vpn deployment #57

Open

Copilot AI reviewed Feb 17, 2026

View reviewed changes

fix: replace medbench with haime

1e09735

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Fix/postprovision#58

Fix/postprovision#58
sashimono-san wants to merge 7 commits intofeature/VPNDeploymentfrom
fix/postprovision

sashimono-san commented Feb 17, 2026

Uh oh!

Copilot AI left a comment

Uh oh!

Copilot AI Feb 17, 2026

Uh oh!

Copilot AI Feb 17, 2026

Uh oh!

Copilot AI Feb 17, 2026

Uh oh!

Copilot AI Feb 17, 2026

Uh oh!

Copilot AI Feb 17, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

	To initialize the project targetting a specific branch, use the `--branch` flag:
	To initialize the project targeting a specific branch, use the `--branch` flag:

Conversation

sashimono-san commented Feb 17, 2026

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Copilot AI Feb 17, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Feb 17, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Feb 17, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Feb 17, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Feb 17, 2026

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants