chore(infra): migrate Bicep -> Terraform (NL naming, ADR-0027, eastus2)#79
Merged
Conversation
…-0027
Two coupled changes in one PR (per follow-up to audit + rename plan):
1. Project rename: bicep projectName default + scripts + workflows flip
from 'whatssummarize' to 'convolens'.
2. Resource naming convention migrates from the legacy
`<type>-<project>-<env>` (`rg-whatssummarize-dev`, `kvwhatssummarizedev`,
`cosmos-whatssummarize-dev`, etc.) to the NL Azure Naming Standard
with the region suffix dropped per mystira ADR-0027 — applied here
for cross-project consistency:
{org}-{env}-{project}-{type} (hyphens for most resources)
{org}{env}{project}{type} (alphanumeric only — Storage)
Region is now expressed by the resource group's `location` property
and the `region` resource tag.
Surfaces touched:
- `infra/bicep/main.bicep` — added `org` parameter (default `'nl'`,
allowed `nl|pvc|tws|mys`); replaced `resourcePrefix`/`resourcePrefixClean`
with `base`/`baseAlphanumeric`; rewrote every module's `name`
interpolation to the new pattern (`${base}-kv`, `${baseAlphanumeric}st`,
`${base}-oai`, `${base}-cosmos`, `${base}-redis`, `${base}-appi`,
`${base}-cae`, `${base}-api`, `${base}-swa`, `${base}-budget`).
Tags object grew an `org` field.
- `infra/parameters/{dev,staging,prod}.bicepparam` — `projectName` flipped
to `convolens`; `org = 'nl'` added explicitly; tags include `org`;
`adminEmail` defaults updated to `convolens.com` placeholders (note:
the convolens.* domain is **not yet registered** — these are inert
until the domain question is resolved, same as the previous
`whatssummarize.com` placeholders were).
- `infra/scripts/deploy.{sh,ps1}` — added `ORG`/`Org`, derived `BASE` /
`Base` and `BASE_ALPHANUMERIC` / `BaseAlphanumeric`; resource group
+ key-vault names rebuilt from `BASE`.
- `infra/scripts/validate-resources.{sh,ps1}` — same pattern; every
resource lookup retargets to the NL-pattern names.
- `.github/workflows/infrastructure.yml` — `AZURE_RESOURCE_GROUP_*`
env vars + dynamic `RG_NAME` use `nl-${env}-convolens-rg`.
- `.github/workflows/release-validation.yml` — full rebuild of resource
name construction inside the validate step (`BASE`, `${BASE}-kv`,
`${ORG}${ENV}${PROJECT}st`, etc.).
- `infra/README.md` — leading note rewritten to describe both renames;
Naming Convention section rewritten with the new pattern + 10
worked examples; Azure CLI examples (`az group create --name
nl-dev-convolens-rg`, `az keyvault set-policy --name
nl-dev-convolens-kv`) and post-deployment endpoints updated.
Cutover plan (separate manual ops, not in this PR):
1. Land this PR — code retargets; no Azure resources are touched.
2. Fix the AAD federated-credential subjects (`AADSTS700213` failure on
`Preview Changes (dev)` since 2025-12-07 — same bug as on omnipost
PR #128). See org-meta handoff
`2026-05-10-azure-rename-plan-omnipost-convolens.md`.
3. Run the dev infrastructure workflow → creates `nl-dev-convolens-rg`
and child resources cleanly.
4. Verify with `infra/scripts/validate-resources.sh dev`.
5. No old resources to decommission — convolens has nothing deployed
under any historical name (verified across all subscriptions).
Out of scope (deferred):
- `.github/settings.yml` repo `name` field — handled with the GitHub
repo rename, not this PR.
- `.github/whatssummarize-mcp-app.json` — webhook live/stale decision.
- `convolens.*` domain registration — open question 2 in the rename
audit.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Contributor
|
Warning Rate limit exceeded
You’ve run out of usage credits. Purchase more in the billing tab. ⌛ How to resolve this issue?After the wait time has elapsed, a review can be triggered using the We recommend that you space out your commits to avoid hitting the rate limit. 🚦 How do rate limits work?CodeRabbit enforces hourly rate limits for each developer per organization. Our paid plans have higher rate limits than the trial, open-source and free plans. In all cases, we re-allow further reviews after a brief timeout. Please see our FAQ for further information. ℹ️ Review info⚙️ Run configurationConfiguration used: Organization UI Review profile: CHILL Plan: Pro Run ID: 📒 Files selected for processing (11)
✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
|
Not up to standards ⛔🔴 Issues
|
| Category | Results |
|---|---|
| ErrorProne | 2 medium |
NEW Get contextual insights on your PRs based on Codacy's metrics, along with PR and Jira context, without leaving GitHub. Enable AI reviewer
TIP This summary will be updated as you push new changes.
- release-validation.yml: fix CAE/CA names to use ${BASE}-cae and
${BASE}-api so they match what bicep deploys (nl-{env}-convolens-*);
align MISSING tags (container-app-api -> container-apps-api) with
the report-table 'container-apps' substring lookup.
- deploy.sh, infrastructure.yml: add org tag to RG creation;
standardise managedBy=bicep across all paths (workflow was using
managedBy=github-actions).
- deploy.sh, deploy.ps1: remove dead BASE_ALPHANUMERIC /
$BaseAlphanumeric variable (unused after storage name moved into
bicep template).
- validate-resources.sh: support COSMOS_DATABASE_NAME env override
so the Cosmos check no longer assumes databaseName == projectName.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Replaces the bicep tree (main + 9 modules + 3 .bicepparam + 4 deploy /
validate scripts) with an equivalent Terraform stack at
infra/terraform/env/dev/.
Why: bicep deployment in eastus repeatedly failed with ServiceUnavailable
on Cosmos DB AZ-redundant accounts despite the template requesting
non-AZ mode. Rather than chase a region-specific bicep workaround,
switch to the AzureRM Terraform pattern already used by sluice; easier
cross-project state hygiene and a single tool to teach.
Stack (env/dev/main.tf):
- RG, Log Analytics, App Insights, Storage Account + 3 blob containers,
Cosmos serverless + 3 SQL containers, Key Vault + 5 secrets,
Container Apps Environment + API Container App, Static Web App.
- Redis and OpenAI flag-gated (off by default in dev). Budget alerts
auto-skip when admin_email is empty.
- Naming follows ADR-0027: {org}-{env}-{project}-{type}, no region suffix.
- Region: eastus2 (healthier Cosmos capacity than eastus).
Remote state:
- nl-tfstate-rg / nltfstateconvolens / tfstate container.
- Key convolens-dev.tfstate. Default azurerm backend (access keys via
Contributor RBAC).
Auth (configured in tenant 9530cd32-9e33-47f0-9247-ed964730b580):
- AAD app convolens-sp (clientId 8f57a349-eb88-40fd-81eb-1065f84e668b).
- Federated cred subject: repo:neuralliquid/convolens:environment:dev.
- Sub-scoped Contributor for the SP on bb4e3882-...
- env-scoped AZURE_CREDENTIALS GitHub secret on environment dev.
Workflow:
- .github/workflows/infrastructure.yml rewritten: validate (fmt-check +
validate), plan (with PR comment), apply (push to main / dispatch),
verify.
- release-validation.yml: comment-only update referencing TF instead
of bicep.
Verified locally: terraform apply succeeded; all 23 resources up in
nl-dev-convolens-rg.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
JustAGhosT
changed the title
Terraform Plan (
|
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Two coupled changes in one PR (per follow-up to the omnipost/convolens rename audit):
projectNamedefault + scripts + workflows flip fromwhatssummarizetoconvolens.<type>-<project>-<env>(rg-whatssummarize-dev,kvwhatssummarizedev,cosmos-whatssummarize-dev, etc.) to the NL Azure Naming Standard with the region suffix dropped per mystira ADR-0027 — applied here for cross-project consistency with the omnipost rename (content_creation #128):Region is expressed by the resource group's
locationproperty and theregionresource tag, not in the resource name.Worked examples (dev)
rg-whatssummarize-devnl-dev-convolens-rgkvwhatssummarizedevnl-dev-convolens-kvstwhatssummarizedevnldevconvolensstcosmos-whatssummarize-devnl-dev-convolens-cosmosoai-whatssummarize-devnl-dev-convolens-oairedis-whatssummarize-devnl-dev-convolens-redisappi-whatssummarize-devnl-dev-convolens-appicae-whatssummarize-devnl-dev-convolens-caeca-whatssummarize-dev-apinl-dev-convolens-apistapp-whatssummarize-devnl-dev-convolens-swaAll names verified against Azure length + character constraints for dev/staging/prod variants.
Surfaces touched
infra/bicep/main.bicep— addedorgparam (default'nl'); replacedresourcePrefix/resourcePrefixCleanwithbase/baseAlphanumeric; rewrote every module'snameinterpolation; tags object grew anorgfield.infra/parameters/{dev,staging,prod}.bicepparam—projectNameflipped toconvolens;org = 'nl'added; tags includeorg;adminEmaildefaults updated toconvolens.complaceholders.infra/scripts/deploy.{sh,ps1}—ORG/Org+BASE/Base+BASE_ALPHANUMERIC/BaseAlphanumericintroduced; RG + KV name from${BASE}.infra/scripts/validate-resources.{sh,ps1}— every resource lookup retargets to the NL-pattern names..github/workflows/infrastructure.yml—AZURE_RESOURCE_GROUP_*env vars + dynamicRG_NAMEusenl-${env}-convolens-rg..github/workflows/release-validation.yml— full rebuild of name construction inside the validate step.infra/README.md— leading note rewritten; full Naming Convention section + 10 worked examples; az-cli examples updated.Cutover plan (separate manual ops, not in this PR)
AADSTS700213failure onPreview Changes (dev)since 2025-12-07 — same bug as on omnipost PR #128). See org-meta handoff2026-05-10-azure-rename-plan-omnipost-convolens.md.nl-dev-convolens-rgand child resources cleanly.infra/scripts/validate-resources.sh dev.Test plan
az bicep buildsucceeds forinfra/bicep/main.bicepdev/staging/prod)nl-dev-convolens-rgcleanlyinfra/scripts/validate-resources.sh devpasses against the new RGOut of scope
.github/settings.ymlreponamefield — handled with the GitHub repo rename, not this PR..github/whatssummarize-mcp-app.json— webhook live/stale decision (deferred).convolens.*domain registration — open question 2 in the rename audit.🤖 Generated with Claude Code