fix: resolve the security incident

[Dhruvkumar-Microsoft]

Purpose

This pull request makes a small but important update to the deployment configuration for both AVM and vanilla Bicep environments. The main change is the addition of a new environment variable, APP_ENV, set to 'prod' for the container app modules. Additionally, the generated ARM templates reflect an updated Bicep compiler version and new template hashes, which are a result of this and possibly other minor changes.

Key changes:

Deployment Configuration Updates

• Added a new environment variable, APP_ENV with the value 'prod', to the container app environment variables in both infra/bicep/main.bicep and infra/avm/main.bicep, ensuring the application runs in production mode by default. [1] [2]
• The corresponding generated ARM templates (main.json in both infra/bicep and infra/avm) now include the APP_ENV variable in the container app's environment variables.

Bicep Compiler and Template Hash Updates

• Updated the Bicep compiler version in the generated ARM templates from 0.44.1.10279 to 0.46.1.21595. This affects the _generator metadata in multiple places. [1] [2]
• Updated template hashes throughout the generated ARM templates to reflect the new compiler version and changes in the source Bicep files. [1] [2] and similar references throughout both main.json files)

No application logic was changed; these updates are focused on deployment environment consistency and template generation.

Does this introduce a breaking change?

• Yes
• No

How to Test

• Get the code

git clone [repo-address]
cd [repo-name]
git checkout [branch-name]
npm install

• Test the code

What to Check

Verify that the following are valid

• ...

Other Information

[github-actions]

Coverage Report •

File	Stmts	Miss	Cover	Missing
agents
agent_template.py	295	123	58%	99, 134, 139, 161–162, 164, 168, 171, 176, 181–187, 192–194, 207, 211–222, 225–229, 232, 234–236, 240–241, 245, 252, 254, 256, 260, 265, 272, 277, 282, 287, 289, 293, 304, 309, 336–339, 356–358, 363–364, 382–385, 388, 390–400, 405, 409–410, 423, 428, 450–456, 460–462, 497, 513, 518, 529–530, 532, 546, 568–569, 596–597, 656, 661, 668, 682–683, 727, 729, 732–733, 736, 738, 746–747, 750–751
common/config
app_config.py	116	7	93%	164–170
TOTAL	3835	552	85%

Tests	Skipped	Failures	Errors	Time
841	0 💤	0 ❌	0 🔥	10.028s ⏱️

[Copilot]

🟡 Changes recommended

The description incorrectly states that application logic and compatibility are unchanged despite narrowing supported development credential sources.

1 open finding

• Document CLI-only Azure authentication and compatibility impact · New

What changed in this PR

Restricts Azure credential selection to Azure CLI in development and managed identity in deployments, while explicitly configuring MCP containers for production.

Changes:

• Replaced DefaultAzureCredential with environment-specific credentials.
• Added credential-selection tests.
• Added APP_ENV=prod and regenerated ARM templates.

File	Description
src/​backend/​common/​config/​app_config.py	Updates credential selection.
src/​backend/​agents/​agent_template.py	Uses CLI or managed identity credentials.
src/​mcp_server/​services/​image_service.py	Updates image-service authentication.
src/​tests/​backend/​common/​config/​test_app_config.py	Updates credential tests.
src/​tests/​backend/​agents/​test_agent_template.py	Updates credential mocks.
src/​tests/​agents/​test_agent_template_integration.py	Updates integration-test mocks.
src/​tests/​mcp_server/​test_image_service.py	Tests environment-based credentials.
infra/​bicep/​main.bicep	Sets MCP production environment.
infra/​avm/​main.bicep	Sets MCP production environment.
infra/​bicep/​main.json	Regenerates vanilla ARM output.
infra/​avm/​main.json	Regenerates AVM ARM output.
infra/​main.json	Regenerates combined ARM output.

🧠 Review effort: Balanced

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.