Configure Azure Developer Pipeline

azure.yaml

@@ -13,12 +13,12 @@ services:
         windows:
           shell: pwsh
           run:  cd ../frontend;npm install;npm run build
-          interactive: true
+          interactive: false
           continueOnError: false
         posix:
           shell: sh
           run:  cd ../frontend;npm install;npm run build
-          interactive: true
+          interactive: false
           continueOnError: false
 pipeline:
   # Set all variables from env as secrets
@@ -39,10 +39,10 @@ hooks:
       windows:
         shell: pwsh
         run: ./scripts/auth_update.ps1;./scripts/prepdocs.ps1
-        interactive: true
+        interactive: false
         continueOnError: false
       posix:
         shell: sh
         run: ./scripts/auth_update.sh;./scripts/prepdocs.sh
-        interactive: true
+        interactive: false
         continueOnError: false

infra/main.bicep

@@ -111,6 +111,9 @@ var keyVaultName = !empty(keyVaultServiceName) ? keyVaultServiceName : '${abbrs.
 var tenantIdForAuth = !empty(authTenantId) ? authTenantId : tenantId
 var authenticationIssuerUri = '${environment().authentication.loginEndpoint}${tenantIdForAuth}/v2.0'
 
+@description('Whether the deployment is running on GitHub Actions')
+param runningOnGhActions string = ''
+
 // Organize resources in a resource group
 resource resourceGroup 'Microsoft.Resources/resourceGroups@2021-04-01' = {
   name: !empty(resourceGroupName) ? resourceGroupName : '${abbrs.resourcesResourceGroups}${environmentName}'
@@ -405,13 +408,15 @@ module storage 'core/storage/storage-account.bicep' = {
 }
 
 // USER ROLES
+var principalType = empty(runningOnGhActions) ? 'User': 'ServicePrincipal'
+
 module openAiRoleUser 'core/security/role.bicep' = if (openAiHost == 'azure') {
   scope: openAiResourceGroup
   name: 'openai-role-user'
   params: {
     principalId: principalId
     roleDefinitionId: '5e0bd9bd-7b93-4f28-af87-19fc36ad61bd'
-    principalType: 'User'
+    principalType: principalType
   }
 }
 
@@ -421,7 +426,7 @@ module formRecognizerRoleUser 'core/security/role.bicep' = {
   params: {
     principalId: principalId
     roleDefinitionId: 'a97b65f3-24c7-4388-baec-2e87135dc908'
-    principalType: 'User'
+    principalType: principalType
   }
 }
 
@@ -431,7 +436,7 @@ module storageRoleUser 'core/security/role.bicep' = {
   params: {
     principalId: principalId
     roleDefinitionId: '2a2b9908-6ea1-4ae2-8e65-a410df84e7d1'
-    principalType: 'User'
+    principalType: principalType
   }
 }
 
@@ -441,7 +446,7 @@ module storageContribRoleUser 'core/security/role.bicep' = {
   params: {
     principalId: principalId
     roleDefinitionId: 'ba92f5b4-2d11-453d-a403-e96b0029c9fe'
-    principalType: 'User'
+    principalType: principalType
   }
 }
 
@@ -451,7 +456,7 @@ module searchRoleUser 'core/security/role.bicep' = {
   params: {
     principalId: principalId
     roleDefinitionId: '1407120a-92aa-4202-b7e9-c0e197c71c8f'
-    principalType: 'User'
+    principalType: principalType
   }
 }
 
@@ -461,7 +466,7 @@ module searchContribRoleUser 'core/security/role.bicep' = {
   params: {
     principalId: principalId
     roleDefinitionId: '8ebe5a00-799e-43f5-93ac-243d3dce84a7'
-    principalType: 'User'
+    principalType: principalType
   }
 }
 
@@ -471,7 +476,7 @@ module searchSvcContribRoleUser 'core/security/role.bicep' = {
   params: {
     principalId: principalId
     roleDefinitionId: '7ca78c08-252a-4471-8644-bb5ff32d4ba0'
-    principalType: 'User'
+    principalType: principalType
   }
 }
 

infra/main.parameters.json

@@ -109,6 +109,9 @@
     },
     "allowedOrigin": {
       "value": "${ALLOWED_ORIGIN}"
+    },
+    "runningOnGhActions": {
+      "value": "${GITHUB_ACTIONS}"
     }
   }
 }