Separate Azure Envs for Dev/Prod#137
Open
moconnell wants to merge 2 commits into
Open
Conversation
📝 WalkthroughWalkthroughThis PR changes Azure deployment from ephemeral PR environments to separate long-lived development and production environments, adds environment-aware infrastructure and Key Vault wiring, refactors deployment automation, and updates CI, scripts, and operational documentation. ChangesAzure environment deployment migration
Estimated code review effort: 4 (Complex) | ~60 minutes Sequence Diagram(s)sequenceDiagram
participant GitHubActions
participant EnvironmentSelection
participant AzureDeployment
participant AzureResources
participant FunctionApp
GitHubActions->>EnvironmentSelection: select branch or manual environment
EnvironmentSelection->>AzureDeployment: validate ref and deployment environment
AzureDeployment->>AzureResources: provision Key Vault, monitoring, and Function App
AzureResources-->>AzureDeployment: return Function App identity and name
AzureDeployment->>FunctionApp: grant Key Vault access and deploy package
AzureDeployment->>FunctionApp: poll admin endpoint
Possibly related PRs
Suggested labels: Suggested reviewers: 🚥 Pre-merge checks | ✅ 4 | ❌ 1❌ Failed checks (1 warning)
✅ Passed checks (4 passed)
✨ Finishing Touches📝 Generate docstrings
🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 3
🧹 Nitpick comments (1)
.azure/function-app.bicep (1)
1-2: 🎯 Functional Correctness | 🔵 Trivial | ⚡ Quick winConstrain
environmentNametodev/prodin all three Bicep templates. All three templates documentenvironmentNameas "dev or prod" but rely on caller discipline rather than enforcing it, so a typo'd value would silently mistag resources instead of failing the deployment.
.azure/function-app.bicep#L1-L2: add@allowed(['dev', 'prod'])aboveparam environmentName string..azure/app-insights.bicep#L4-L8: add the same@allowed(['dev', 'prod'])decorator..azure/key-vault.bicep#L4-L5: add the same@allowed(['dev', 'prod'])decorator.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In @.azure/function-app.bicep around lines 1 - 2, Constrain the environmentName parameter to the supported values by adding the allowed decorator for dev and prod in .azure/function-app.bicep lines 1-2, .azure/app-insights.bicep lines 4-8, and .azure/key-vault.bicep lines 4-5. Keep the existing parameter names and types unchanged.
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.azure/key-vault.bicep:
- Around line 20-31: Decide and implement an explicit network-access
architecture for the Key Vault configuration in the resource properties: either
retain public access with documented restrictions, or enforce private
connectivity/static egress allowlisting while preserving the documented manual
secret-update workflow. Update publicNetworkAccess and networkAcls consistently,
and ensure GitHub-hosted runners or operator machines can still reach the vault
through the chosen approved path.
In @.github/workflows/deploy-azure-functions.yml:
- Around line 33-58: Update the “Select and validate environment” step to pass
github.event_name, inputs.environment, and github.ref through the step’s env
block, then reference the resulting shell variables instead of interpolating
GitHub expressions inside run. Apply the same pattern to later deploy-job vars.*
and steps.*.outputs values that are inserted directly into shell scripts,
preserving the existing environment-selection and validation behavior.
In `@scripts/generate-eth-keypair.py`:
- Around line 55-62: Remove the unnecessary f-string prefixes from the
non-interpolated print statements in the keypair output block, including the
Azure Key Vault command lines surrounding the interpolated address line. Keep
the interpolated print unchanged and preserve the generated command text.
---
Nitpick comments:
In @.azure/function-app.bicep:
- Around line 1-2: Constrain the environmentName parameter to the supported
values by adding the allowed decorator for dev and prod in
.azure/function-app.bicep lines 1-2, .azure/app-insights.bicep lines 4-8, and
.azure/key-vault.bicep lines 4-5. Keep the existing parameter names and types
unchanged.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: defaults
Review profile: CHILL
Plan: Pro
Run ID: 1f86c7ad-fc7f-4d7f-8306-74f3bcae0b9c
📒 Files selected for processing (13)
.azure/app-insights.bicep.azure/function-app.bicep.azure/key-vault.bicep.github/dependabot.yml.github/workflows/cleanup-azure-functions.yml.github/workflows/deploy-azure-functions.yml.github/workflows/dotnet.ymldocs/AZURE-KEY-VAULT-SECRETS-SETUP.mddocs/CONFIGURATION-ARCHITECTURE.mddocs/DEPLOYMENT.mddocs/HYPERLIQUID-WALLET-ARCHITECTURE.mdscripts/generate-eth-keypair.pyscripts/setup-azure.sh
💤 Files with no reviewable changes (2)
- .github/workflows/cleanup-azure-functions.yml
- .github/workflows/dotnet.yml
There was a problem hiding this comment.
Caution
Some comments are outside the diff and can’t be posted inline due to platform limitations.
⚠️ Outside diff range comments (1)
.github/workflows/deploy-azure-functions.yml (1)
278-278: 🩺 Stability & Availability | 🟠 Major | ⚡ Quick winPrevent script termination on
curlnetwork errors.Because GitHub Actions uses
set -eby default in bash scripts, ifcurlfails to connect (e.g., DNS not yet propagated or connection refused during app startup), the command exits with a non-zero status. This causes the entire step to abort immediately, bypassing your retry loop.Append
|| trueinside the subshell to safely swallow network failures, ensuring the status remains empty and the loop continues as intended.♻️ Proposed fix
- STATUS=$(curl --silent --output /dev/null --write-out "%{http_code}" "https://$HOSTNAME/admin/functions") + STATUS=$(curl --silent --output /dev/null --write-out "%{http_code}" "https://$HOSTNAME/admin/functions" || true)🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In @.github/workflows/deploy-azure-functions.yml at line 278, Update the curl status assignment in the deployment retry loop to tolerate network failures under set -e by appending a failure fallback inside the command substitution. Preserve the existing HTTP status capture while ensuring failed requests leave STATUS empty and allow the loop to continue.
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Outside diff comments:
In @.github/workflows/deploy-azure-functions.yml:
- Line 278: Update the curl status assignment in the deployment retry loop to
tolerate network failures under set -e by appending a failure fallback inside
the command substitution. Preserve the existing HTTP status capture while
ensuring failed requests leave STATUS empty and allow the loop to continue.
ℹ️ Review info
⚙️ Run configuration
Configuration used: defaults
Review profile: CHILL
Plan: Pro
Run ID: 2fd87534-3a67-4236-97ac-33243de41a67
📒 Files selected for processing (6)
.azure/app-insights.bicep.azure/function-app.bicep.azure/key-vault.bicep.github/workflows/deploy-azure-functions.ymldocs/AZURE-KEY-VAULT-SECRETS-SETUP.mdscripts/generate-eth-keypair.py
🚧 Files skipped from review as they are similar to previous changes (5)
- .azure/app-insights.bicep
- docs/AZURE-KEY-VAULT-SECRETS-SETUP.md
- .azure/function-app.bicep
- .azure/key-vault.bicep
- scripts/generate-eth-keypair.py
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary by CodeRabbit
New Features
Bug Fixes
Documentation
Chores