Honor system env vars as first option for compiling bicep when running on CI/CD

[vhvb1989]

input params are automatically mapped to ENV VARS when using Aspire. But, the primary strategy for azd to handle parameters is to use the environment configuration. Even if the environment variable which is mapped to an input parameter is set on CI env, azd tries to prompt if the value is not defined in the environment config. See: #4151

I talked to @ellismg in the past and agreed that, when running on CI, azd should check the system environment and respect the mapping before looking at environment-config.

This would enable folks to set unique env var secrets for each input, instead of using the AZD_INITIAL_ENVIRONMENT_CONFIG secret, holding all prompts values.

[kyurkchyan]

For anybody interested in this issue, here's how I've worked it around.

Instead of setting the whole config.json text content inside the AZD_INITIAL_ENVIRONMENT_CONFIG environment variable in azure devops library, I've created a script to generate the value of AZD_INITIAL_ENVIRONMENT_CONFIG on the fly.

param (
    [Parameter(Mandatory = $true)]
    [hashtable]$ParameterMappings
)

$config = @{
    infra = @{
        parameters = @{}
    }
}

foreach ($param in $ParameterMappings.GetEnumerator()) {
    $paramName = $param.Key
    $envVarName = $param.Value
    
    $envValue = [System.Environment]::GetEnvironmentVariable($envVarName)
    
    if ($null -eq $envValue) {
        Write-Warning "Environment variable '$envVarName' not found for parameter '$paramName'"
        continue
    }
    
    $config.infra.parameters[$paramName] = $envValue
}

$jsonConfig = $config | ConvertTo-Json -Depth 10 -Compress
Add-Type -AssemblyName System.Web
$escapedJson = [System.Web.HttpUtility]::JavaScriptStringEncode($jsonConfig)
Write-Host "##vso[task.setvariable variable=AZD_INITIAL_ENVIRONMENT_CONFIG;isOutput=true;]$escapedJson"
$env:AZD_INITIAL_ENVIRONMENT_CONFIG = $escapedJson

Then, you can use this script inside your azd provision step like this

                - task: AzureCLI@2
                  displayName: Provision Infrastructure
                  inputs:
                    azureSubscription: ${{ parameters.AzureServiceConnection }}
                    scriptType: pscore
                    scriptLocation: inlineScript
                    keepAzSessionActive: true
                    inlineScript: |
                      $(Build.SourcesDirectory)/infra/scripts/GenerateAzdConfig.ps1 `
                        -ParameterMappings @{
                            'postgresAdminPassword' = 'AZURE_POSTGRES_ADMIN_PASSWORD';
                            'postgresAdminUser' = 'AZURE_POSTGRES_ADMIN_USER'
                        }
                      Write-Host "AZD_INITIAL_ENVIRONMENT_CONFIG is"
                      Write-Host $env:AZD_INITIAL_ENVIRONMENT_CONFIG
                      azd provision --no-prompt
                  env:
                    AZURE_SUBSCRIPTION_ID: $(AZURE_SUBSCRIPTION_ID)
                    AZURE_POSTGRES_ADMIN_PASSWORD: $(AZURE_POSTGRES_ADMIN_PASSWORD)
                    AZURE_POSTGRES_ADMIN_USER: $(AZURE_POSTGRES_ADMIN_USER)

The script will iterate over the provided key-value pairs, read the environment variable values, set them inside json and output the result json into the AZD_INITIAL_ENVIRONMENT_CONFIG variable.

[ncelisabet]

I rewrote @kyurkchyan s idea in bash/github language. It is rather crude, but it works:

.github/workflows/scripts:

#!/bin/bash

config='{"infra":{"parameters":{}}}'

for var in "$@"
do
  IFS='=' read -ra kv_pair <<< "$var"
  key="${kv_pair[0]}"
  value="${kv_pair[1]}"
  config=$(echo "$config" | jq --arg key "$key" --arg value "$value" '.infra.parameters[$key] = $value')
done

escapedJson=$(echo "$config" | jq -cr @json)
echo "config=$escapedJson" >> "$GITHUB_OUTPUT"

.github/workflows/azure-dev.yml

  - name: Init configuration file
    id: config
    run: |
      ./.github/workflows/scripts/generate-azd-config.sh \
        firstSecret=${{ secrets.SUPER_SECRET_VALUE }} \
        anotherSecret=${{ env.THIS_SECRET_IS_IN_ENV }}
  - name: Provision Infrastructure
    run: |
      azd provision --no-prompt
    env:
      AZD_INITIAL_ENVIRONMENT_CONFIG: ${{ steps.config.outputs.config }}

[vhvb1989]

This is fixed by
#5143
#5190

Please use and try with AZD 1.16.0. Re-open if you still observe issues.