Docs: add Bicep and Terraform infrastructure guidance to azd ai CI/CD article

[therealjohn]

Documentation gap

The Microsoft Learn article Set up CI/CD for hosted agents with the Azure Developer CLI currently describes azd provision as creating or updating infrastructure from Bicep templates. It does not explain the equivalent CI/CD setup for Terraform or clearly distinguish the provider-specific requirements for azd ai projects.

Requested update

Add an Infrastructure as code section that:

• Covers both Bicep and Terraform for azd ai hosted-agent projects.
• Explains that Bicep is the default IaC provider and shows how Terraform is selected in azure.yaml:

  infra:
    provider: terraform

• Documents the expected infra/ layout and the azd provision / azd deploy pipeline flow for each provider.
• Explains Terraform's remote-state requirement before running azd pipeline config.
• Covers non-interactive authentication and required variables or secrets for GitHub Actions and Azure Pipelines.
• Includes provider-specific validation, environment promotion, rollback/recovery, and troubleshooting guidance.
• Links to the existing Terraform with azd and azd CI/CD documentation.

Acceptance criteria

• The hosted-agent CI/CD article has complete Bicep and Terraform paths.
• Each path includes prerequisites, configuration, pipeline behavior, and troubleshooting.
• GitHub Actions and Azure Pipelines are both covered.
• A reader can configure an azd ai project and run its infrastructure deployment in CI/CD without relying on Bicep-only assumptions.

[therealjohn]

Also consider where we can document dataplane resources with Terraform like:

resource "azapi_data_plane_resource" "hosted_agent" {
  type      = "Microsoft.Foundry/agents@v1"
  name      = var.agent_name
  parent_id = trimprefix(var.project_endpoint, "https://")

  body = {
    name = var.agent_name
    definition = {
      kind = "hosted"
      container_configuration = {
        image = var.image_uri
      }
      cpu    = "0.25"
      memory = "0.5Gi"
      protocol_versions = [
        {
          protocol = "responses"
          version  = "2.0.0"
        }
      ]
      environment_variables = merge(var.environment_variables, {
        AZURE_AI_MODEL_DEPLOYMENT_NAME = var.model_deployment_name
      })
      rai_config = {
        rai_policy_name = var.rai_policy_id
      }
    }
  }
}

And a way to check if the agent is ready like:

resource "terraform_data" "hosted_agent_status" {
  triggers_replace = tostring(azapi_data_plane_resource.insights_hosted_agent.output.versions.latest.version)
  provisioner "local-exec" {
    interpreter = ["pwsh", "-NoProfile", "-NonInteractive", "-Command"]
    command     = "& '${path.module}/scripts/Get-HostedAgentStatus.ps1'"

    environment = {
      PROJECT_ENDPOINT      = data.terraform_remote_state.compute.outputs.core_ai_foundry_project_endpoint
      AGENT_NAME            = local.hosted_agent_name
      AGENT_VERSION         = tostring(azapi_data_plane_resource.insights_hosted_agent.output.versions.latest.version)
      TIMEOUT_SECONDS       = "300"
      POLL_INTERVAL_SECONDS = "10"
    }
  }
}

This might need to be a separate issue because if these resources are defined in IaC, that would conflict with what the azd ai agent deploy hook does and duplicate resource creation.