Add PR preview environment with #deploy comment trigger

[Copilot]

Enables quick testing of PRs in isolated Azure environments. Comment #deploy on any PR to spin up a live preview with app + Cosmos DB emulator. Resources auto-cleanup on PR close. Supports both OIDC and service principal authentication for Azure.

Note: Preview environments use HTTP only as Azure Container Instances don't provide built-in SSL/TLS termination. Comprehensive documentation provided for HTTPS options if required.

Implementation

GitHub-agnostic deployment script (scripts/deploy-pr-preview.sh)

• Builds Docker image, tags with pr-{NUMBER}-{SHA} and pr-{NUMBER}-latest
• Pushes to ACR
• Works from any CI/CD or manually

Deploy workflow (.github/workflows/pr-preview-deploy.yml)

• Triggers on #deploy comment (issue_comment event)
• Adds 🚀 reaction, builds image, deploys to Azure Container Instances
• Multi-container deployment via ACI YAML (app + Cosmos emulator)
• Comments back with FQDN: http://iq-pr-{NUMBER}.{region}.azurecontainer.io
• Supports both OIDC and service principal authentication with automatic fallback
• Includes warning about HTTP-only access with link to HTTPS options

Cleanup workflow (.github/workflows/pr-preview-cleanup.yml)

• Triggers on PR close
• Deletes container instance, comments confirmation
• Supports both OIDC and service principal authentication

Multi-container template (azure-container-instance.yml)

• App container: 1 CPU, 1 GB (PR image from ACR)
• Cosmos DB emulator: 2 CPU, 3 GB (well-known test credentials)
• Public IP with unique DNS label per PR

SSL/TLS Considerations

Azure Container Instances don't provide built-in SSL/TLS termination, so preview environments are accessible via HTTP only. This is acceptable for temporary testing environments with no production data.

HTTPS options documented if required:

1. Accept HTTP for temporary previews (recommended)
2. Azure Application Gateway with SSL termination (production-grade)
3. Migrate to Azure Container Apps (built-in HTTPS)
4. Reverse proxy container with Let's Encrypt (intermediate)

See docs/PR-PREVIEW.md for detailed SSL/TLS options and implementation guidance.

Configuration Required

Set GitHub secrets before use:

For OIDC Authentication (Recommended):

• AZURE_CLIENT_ID - Application (client) ID
• AZURE_TENANT_ID - Directory (tenant) ID
• AZURE_SUBSCRIPTION_ID - Subscription ID
• ACR_NAME - Container registry name
• AZURE_RESOURCE_GROUP - Preview deployment resource group
• AZURE_LOCATION - (optional) Defaults to eastus

For Service Principal Authentication (Legacy):

• AZURE_CREDENTIALS - Service principal JSON with Contributor + AcrPush roles
• ACR_NAME - Container registry name
• AZURE_RESOURCE_GROUP - Preview deployment resource group
• AZURE_LOCATION - (optional) Defaults to eastus

See docs/PR-PREVIEW-SETUP.md for detailed setup instructions for both authentication methods.

Usage

# In a PR, comment:
#deploy

# Preview deployed → bot comments with URL (HTTP only)
# Close PR → automatic cleanup

Original prompt

---

This section details on the original issue you should resolve

<issue_title>Easy pull request preview environment</issue_title>
<issue_description>I want to be able to quickly test a pull request in a live environment.

• create a bash script that will compile the Docker images and push them in acr. Tags must have git sha and pr number. The script must be GitHub agnostix
• create a GitHub action that, when the comment #deploy is made to a PR, will first add an emoji to that comment, deploy everything on Azure container instance (the app and the cosmos dB emulator via compose), and then comment with the FQDN.
• when the PR is closed, that azure container instance must be deleted. </issue_description>

Comments on the Issue (you are Copilot in this section)

• Fixes Easy pull request preview environment #8

---

💡 You can make Copilot smarter by setting up custom instructions, customizing its development environment and configuring Model Context Protocol (MCP) servers. Learn more Copilot coding agent tips in the docs.

[Christopher MANEU (cmaneu)]

Copilot ensures we can use OIDC for connecting GitHub to Azure

[Copilot]

Copilot ensures we can use OIDC for connecting GitHub to Azure

Added OIDC authentication support in commit af21ff6.

The workflows now support both authentication methods:

• OIDC (recommended): Uses federated credentials with AZURE_CLIENT_ID, AZURE_TENANT_ID, and AZURE_SUBSCRIPTION_ID secrets
• Service Principal (legacy): Uses AZURE_CREDENTIALS JSON secret as fallback

Both workflows include id-token: write permission and automatically try OIDC first, then fallback to service principal if OIDC secrets aren't configured.

See updated docs/PR-PREVIEW-SETUP.md for complete OIDC setup instructions including federated credential configuration.

[Christopher MANEU (cmaneu)]

Copilot Azure Container Instances don't do SSL termination by default, how this could work and how can you fix it?

[Christopher MANEU (cmaneu)]

Copilot Azure Container Instances don't do SSL termination by default, how this could work and how can you fix it?

[Copilot]

Copilot Azure Container Instances don't do SSL termination by default, how this could work and how can you fix it?

Azure Container Instances don't provide built-in SSL/TLS termination, so preview environments use HTTP only. This is documented in commit ee43488.

Why HTTP is acceptable for PR previews:

• Temporary testing environments (auto-deleted when PR closes)
• Uses Cosmos DB emulator (no production data)
• Isolated per PR with no sensitive information

If HTTPS is required, 4 options are documented:

1. Accept HTTP (simplest, recommended for previews)
2. Azure Application Gateway with SSL termination (~$0.05/hr additional cost)
3. Azure Container Apps migration (built-in HTTPS with managed certificates)
4. Reverse proxy container (nginx/Caddy with Let's Encrypt)

See docs/PR-PREVIEW.md SSL/TLS section for detailed guidance on each option. The PR comment now includes a warning about HTTP-only access.

Copilot Azure Container Instances don't do SSL termination by default, how this could work and how can you fix it?

Azure Container Instances don't provide built-in SSL/TLS termination, so preview environments use HTTP only. This is documented in commit ee43488.

Why HTTP is acceptable for PR previews:

• Temporary testing environments (auto-deleted when PR closes)
• Uses Cosmos DB emulator (no production data)
• Isolated per PR with no sensitive information

If HTTPS is required, 4 options are documented:

1. Accept HTTP (simplest, recommended for previews)
2. Azure Application Gateway with SSL termination (~$0.05/hr additional cost)
3. Azure Container Apps migration (built-in HTTPS with managed certificates)
4. Reverse proxy container (nginx/Caddy with Let's Encrypt)

See docs/PR-PREVIEW.md SSL/TLS section for detailed guidance on each option. The PR comment now includes a warning about HTTP-only access.