Deploy workflows: provision and deploy jobs never install the azd extension nor run 'azd auth login'

[placerda]

Summary

The generated agentops-deploy-*-azd.yml workflows install the azd AI agents extension and authenticate azd only in the eval job. The provision and deploy jobs get neither, so both fail immediately on a clean runner.

Two independent blockers, hit in sequence on a real deployment:

1. azd extension install azure.ai.agents is missing → the extension that implements infra: provider: microsoft.foundry is not present.
2. azd auth login is missing → azure/login@v3 authenticates the Azure CLI, not azd. azd keeps its own credential store and does not fall back to the az session.

Repro

1. Scaffold a Foundry hosted-agent project (azure.yaml with infra: provider: microsoft.foundry).
2. agentops workflow generate --kinds pr,dev
3. Configure GitHub OIDC for environment dev.
4. gh workflow run agentops-deploy-dev.yml --ref main -f provision=true

Blocker 1

ERROR: Auto-installation is not supported in CI/CD environments.
Run 'azd extension install azure.ai.agents' to install it manually.

Blocker 2 (after fixing 1)

ERROR: not logged in, run 'azd auth login' to login

Job fails in ~19 s. The azure/login (OIDC) step immediately above succeeded.

Root cause

src/agentops/templates/workflows/agentops-deploy-dev-azd.yml (same shape in -qa- and -prod-):

Line	Step	Job
51	Azure login (OIDC)	provision
58	Prepare azd environment	provision
74	Run azd provision	provision
98	Azure login (OIDC)	eval
143	Azure login (OIDC)	deploy
150	Run azd deploy	deploy

Neither azd auth login nor azd extension install appears anywhere between lines 51-74 or 143-150. services/cicd.py:440 and :639 emit the extension install for the eval job only.

grep -r "azd auth login" src/agentops returns zero matches across all four templates.

The eval job works because agentops (Python) authenticates through azure-identity, which reads the Azure CLI session created by azure/login. Only jobs that shell out to the azd binary are affected.

Suggested fix

Add both steps to provision and deploy in all three azd deploy templates.

Extension install (mirrors the existing eval-job step, reusing AZD_AI_AGENTS_EXTENSION_VERSION from pipeline/official_eval.py):

      - name: Install pinned azd AI agents extension
        env:
          AGENTOPS_AZD_AI_AGENTS_EXTENSION_VERSION: "1.0.0-beta.9"
        run: |
          azd extension install azure.ai.agents --version "$AGENTOPS_AZD_AI_AGENTS_EXTENSION_VERSION"

azd auth, per cli/azd/docs/authentication.md ("GitHub Actions" section):

      - name: azd auth login (OIDC)
        run: |
          azd auth login \
            --client-id "$AZURE_CLIENT_ID" \
            --tenant-id "$AZURE_TENANT_ID" \
            --federated-credential-provider github
        env:
          AZURE_CLIENT_ID: ${{ vars.AZURE_CLIENT_ID }}
          AZURE_TENANT_ID: ${{ vars.AZURE_TENANT_ID }}

This requires ACTIONS_ID_TOKEN_REQUEST_URL / ACTIONS_ID_TOKEN_REQUEST_TOKEN, which GitHub injects automatically when id-token: write is granted. The generated workflows already grant it at workflow level, so no permission change is needed.

azd config set auth.useAzCliAuth true is the documented alternative, but it makes the runner depend on the Azure CLI being present and pre-authenticated. Explicit azd auth login is the option the azd docs recommend for CI.

Validation

Both steps applied by hand to a generated agentops-deploy-dev.yml, then dispatched:

(✓) Done: Installing azure.ai.agents extension (1.0.0-beta.9)
SUCCESS: Extension(s) installed successfully
...
ERROR: deployment failed: ... arm_deployment_create: PUT https://management.azure.com/subscriptions/.../deployments/azd-foundry-dev-0b0c8ef4
ERROR CODE: AuthorizationFailed

The run now reaches the ARM control plane and fails on an unrelated RBAC gap in my sandbox (the subscription-scoped deployment needs Contributor at subscription scope, my service principal only had it on the resource group). Both blockers above are cleared.

Side note

azd provision with provider: microsoft.foundry issues a subscription-scoped deployment (/subscriptions/<id>/providers/Microsoft.Resources/deployments/azd-foundry-<env>-<hash>). The AgentOps CI/OIDC docs describe resource-group-scoped role assignments, which are not sufficient. Worth calling out explicitly in the OIDC setup guidance, otherwise every first deployment fails with AuthorizationFailed after a green PR gate.

[placerda]

Fixed in #386 (merged to develop as 46f4b10).