Add AI MicroHack: Inventory Planning with Microsoft Fabric (low-code)

03-Azure/01-04-AI/02_Inventory_Planning_Fabric/.github/agents/hack-compliance-validator.agent.md

@@ -0,0 +1,62 @@
+---
+description: "Use when you want to validate that this hack is fully compliant with the microsoft/MicroHack platform conventions. Checks directory naming, deploy-lab.ps1 parameter contract, lab-defaults.json schema validity, platform integration rules (no Connect-AzAccount, no premature RG creation), credential return pattern, and content structure. Run before committing or requesting platform access."
+name: "Hack Compliance Validator"
+tools: [read, search]
+user-invocable: true
+argument-hint: "Validate this hack for EMEA platform compliance"
+---
+
+You are a strict EMEA MicroHack platform compliance auditor based on [microsoft/MicroHack](https://github.com/microsoft/MicroHack).
+Inspect this workspace and produce a pass/fail report against every mandatory convention.
+
+## Compliance Checklist
+
+Work through each item. Mark ✅ PASS or ❌ FAIL with a brief reason.
+
+### 1. Directory Structure
+- [ ] `labautomation/` directory exists (no dashes — exactly `labautomation`).
+- [ ] `labautomation/` contains **only** `deploy-lab.ps1`, `lab-defaults.json`, and `README.md` — no stray files (facilitator notes, runbooks, secrets, etc.). One-time setup / prerequisite docs belong in `walkthrough/` or a separate top-level folder, not here.
+- [ ] `labautomation/lab-defaults.json` exists.
+- [ ] `labautomation/README.md` exists.
+- [ ] A root readme exists **and its casing matches every link that targets it**. GitHub is case-sensitive: if files in `challenges/` or `walkthrough/` link to `../Readme.md`, the root file MUST be `Readme.md` (not `README.md`), and vice-versa. Flag any mismatch as **blocking** — the "Home" navigation links 404 on GitHub even though they resolve on Windows.
+- [ ] `challenges/` directory exists.
+- [ ] `walkthrough/` directory exists.
+
+### 2. deploy-lab.ps1 — Parameter Contract
+- [ ] `labautomation/deploy-lab.ps1` exists (optional but recommended).
+- [ ] If it exists: parameter block declares exactly `$DeploymentType`, `$SubscriptionId`, `$ResourceGroupName`, `$PreferredLocation`, `$AllowedEntraUserIds`.
+- [ ] `$DeploymentType` has `[ValidateSet('subscription','resourcegroup','resourcegroup-with-subscriptionowner')]`.
+
+### 3. deploy-lab.ps1 — Platform Integration Rules
+- [ ] Script does **NOT** call `Connect-AzAccount` (platform pre-sets Az context).
+- [ ] For `resourcegroup` deployment type: script does **NOT** call `New-AzResourceGroup` (platform pre-creates it).
+- [ ] For `subscription` deployment type: script uses `Get-MhhStableHash` to generate a deterministic RG name.
+- [ ] Any `Get-MhhStableHash` call passes `-Length` within the valid **12–64** range. Values below 12 throw at runtime and silently fail the whole deployment — flag as **blocking**.
+
+### 4. deploy-lab.ps1 — Credential Return
+- [ ] Script emits at least one `@{ HackboxCredential = @{ name = ...; value = ...; note = ... } }` to the output stream.
+
+### 5. lab-defaults.json — Schema Validity
+- [ ] File is valid JSON (no comments, no trailing commas).
+- [ ] Contains `"$schema"` pointing to the MicroHack schema URL.
+- [ ] `deploymentType` is one of: `"resourcegroup"`, `"resourcegroup-with-subscriptionowner"`, `"subscription"`.
+- [ ] `preferredLocation` is a comma-separated string of Azure region names.
+- [ ] `estimatedDailyCostsUsd` is a non-negative number.
+
+### 6. Platform Compatibility
+- [ ] No hard-coded corporate network, specific DNS, or environment-specific blocks.
+- [ ] Script works for on-site, online, and hybrid event formats.
+
+---
+
+## How to Run
+
+1. Use `#tool:search` and `#tool:read` to locate and read each required file.
+2. For each checklist item, read the relevant section and determine pass/fail.
+3. Output the full checklist with ✅/❌ status.
+4. Output a **Summary** section:
+   - Total: X/6 categories passing
+   - Blocking issues (❌ on categories 1–5 are blocking)
+   - Recommendations (non-blocking improvements)
+
+Be strict. A missing `$schema` in lab-defaults.json or a wrong parameter name in deploy-lab.ps1 causes the platform to skip the script silently — flag these as blocking. A root-readme casing mismatch and an out-of-range `Get-MhhStableHash -Length` are also blocking (broken GitHub links / runtime failure respectively).

03-Azure/01-04-AI/02_Inventory_Planning_Fabric/.github/copilot-instructions.md

@@ -0,0 +1,80 @@
+# MicroHack Lab — EMEA Platform Conventions
+
+This workspace is a microhack lab for the **EMEA MicroHack platform** ([microsoft/MicroHack](https://github.com/microsoft/MicroHack)).
+The platform renders a front-end UI, but **all resource provisioning comes from `labautomation/deploy-lab.ps1`**.
+Without a working deployment script, no resources appear in the Azure portal — the platform is just a shiny front end.
+
+## Mandatory Structure
+
+```
+labautomation/          ← exactly this name, no dashes
+  deploy-lab.ps1        ← platform entry point (optional but recommended)
+  lab-defaults.json     ← platform configuration (required if folder exists)
+  README.md             ← usage notes
+challenges/             ← challenge instructions (Markdown)
+walkthrough/            ← solutions
+README.md               ← hack intro, objectives, prerequisites
+```
+
+## deploy-lab.ps1 — Parameter Contract
+
+The platform **skips the script** if the parameter block does not exactly match:
+
+```powershell
+param(
+    [Parameter(Mandatory=$true)]
+    [ValidateSet('subscription','resourcegroup','resourcegroup-with-subscriptionowner')]
+    [string]$DeploymentType,
+
+    [Parameter(Mandatory=$true)]
+    [string]$SubscriptionId,
+
+    [string]$ResourceGroupName = "",
+
+    [string[]]$PreferredLocation = @(),
+
+    [string[]]$AllowedEntraUserIds = @()
+)
+```
+
+## Platform Guarantees (before your script runs)
+
+- Az context is already set to `$SubscriptionId` — **do NOT call `Connect-AzAccount`**
+- For `resourcegroup`/`resourcegroup-with-subscriptionowner`: the RG exists and your script has `Owner` — **do NOT call `New-AzResourceGroup`**
+- For `subscription`: your script has `Owner` on the subscription; **you must create the RG yourself** using `Get-MhhStableHash` for deterministic naming
+- `Az.Accounts` and `Az.Resources` modules are already imported
+
+## lab-defaults.json — Required Shape
+
+```json
+{
+  "$schema": "https://raw.githubusercontent.com/microsoft/MicroHack/refs/heads/main/lab-defaults-schema.json",
+  "groups": [],
+  "deploymentType": "resourcegroup",
+  "labsPerSubscription": 4,
+  "preferredLocation": "westeurope, swedencentral, norwayeast",
+  "estimatedDailyCostsUsd": 5.0
+}
+```
+
+- `deploymentType`: `"resourcegroup"` | `"resourcegroup-with-subscriptionowner"` | `"subscription"`
+- `groups`: `[]` (Azure only), `["GHCPUsers"]` (GitHub Copilot seat), `["M365-E5-Users"]` (M365 E5)
+- `preferredLocation`: comma-separated regions, priority order
+- `estimatedDailyCostsUsd`: per-user per-day cost for the lifecycle wizard
+
+## Returning Credentials to Users
+
+Write a hashtable to the output stream — the platform captures it and shows it on the user's dashboard:
+
+```powershell
+@{ HackboxCredential = @{ name = "AdminPassword"; value = "TopSecret!"; note = "VM admin password" } }
+```
+
+## Delivery Deadline
+
+Labs must have at least a skeleton committed by **end of July** — September events are already scheduled.
+
+## Platform Compatibility
+
+The platform supports **on-site**, **online**, and **hybrid** delivery.
+Do not hard-code corporate network or specific DNS assumptions.

03-Azure/01-04-AI/02_Inventory_Planning_Fabric/.github/instructions/labautomation.instructions.md

@@ -0,0 +1,101 @@
+---
+description: "Use when creating, editing, or reviewing labautomation/deploy-lab.ps1, lab-defaults.json, or any PowerShell helper inside labautomation/. Enforces microsoft/MicroHack platform deployment conventions."
+applyTo: "labautomation/**"
+---
+
+# Lab Automation Conventions (microsoft/MicroHack)
+
+## deploy-lab.ps1 — Required Parameter Contract
+
+The platform **silently skips** the script if the parameter block does not match exactly:
+
+```powershell
+param(
+    [Parameter(Mandatory=$true)]
+    [ValidateSet('subscription','resourcegroup','resourcegroup-with-subscriptionowner')]
+    [string]$DeploymentType,
+
+    [Parameter(Mandatory=$true)]
+    [string]$SubscriptionId,
+
+    [string]$ResourceGroupName = "",
+
+    [string[]]$PreferredLocation = @(),
+
+    [string[]]$AllowedEntraUserIds = @()
+)
+```
+
+## Critical Platform Rules
+
+**NEVER do these — they break platform integration:**
+
+```powershell
+# WRONG — platform already sets Az context
+Connect-AzAccount
+
+# WRONG — platform pre-creates the RG for resourcegroup deployments
+New-AzResourceGroup -Name $ResourceGroupName ...
+```
+
+**For `subscription` deployments only** — you must create your own RG using a deterministic name:
+
+```powershell
+$stableHash = Get-MhhStableHash $AllowedEntraUserIds -Length 24
+$effectiveResourceGroup = "lab-$stableHash"
+New-AzResourceGroup -Name $effectiveResourceGroup -Location $effectiveLocation
+```
+
+## Resolving Effective Location
+
+```powershell
+$effectiveLocation = if ($PreferredLocation.Count -gt 0) { $PreferredLocation[0] } else { "westeurope" }
+```
+
+## Deploying Resources
+
+Reference templates relative to `$scriptPath`:
+
+```powershell
+$scriptPath = Split-Path -Parent $MyInvocation.MyCommand.Definition
+$template = Join-Path $scriptPath "template.bicep"
+New-AzResourceGroupDeployment -ResourceGroupName $effectiveResourceGroup -TemplateFile $template -Verbose
+```
+
+## Returning Credentials to the User Dashboard
+
+Write a hashtable to the output stream — the platform captures every one:
+
+```powershell
+@{ HackboxCredential = @{ name = "AdminPassword"; value = "TopSecret!"; note = "VM admin password" } }
+```
+
+Always return at minimum the resource group name so users can find their resources.
+
+## lab-defaults.json — Required Shape
+
+```json
+{
+  "$schema": "https://raw.githubusercontent.com/microsoft/MicroHack/refs/heads/main/lab-defaults-schema.json",
+  "groups": [],
+  "deploymentType": "resourcegroup",
+  "labsPerSubscription": 4,
+  "preferredLocation": "westeurope, swedencentral, norwayeast",
+  "estimatedDailyCostsUsd": 5.0
+}
+```
+
+- `$schema` is **required** — the platform validates against it
+- `deploymentType`: `"resourcegroup"` | `"resourcegroup-with-subscriptionowner"` | `"subscription"`
+- `groups`: `[]` for Azure-only; add `"GHCPUsers"` or `"M365-E5-Users"` as needed
+- `preferredLocation`: comma-separated regions in priority order — list multiple for regional fallback
+- `estimatedDailyCostsUsd`: cost per user per day; used in the lifecycle cost wizard
+
+## Available Platform Helper Cmdlets
+
+| Cmdlet | Use |
+|--------|-----|
+| `Get-MhhStableHash` | Deterministic per-user hash for resource naming in `subscription` mode |
+| `Get-MhhLabUser` | Get Entra user details for `$AllowedEntraUserIds` |
+| `Invoke-MhhDeploymentWithRegionFallback` | Deploy with automatic region fallback |
+| `Test-MhhDeploymentFailureRetryable` | Check if a deployment error is transient |

03-Azure/01-04-AI/02_Inventory_Planning_Fabric/.github/prompts/scaffold-lab-automation.prompt.md

@@ -0,0 +1,86 @@
+---
+description: "Scaffold a complete labautomation/ directory for a new EMEA MicroHack. Generates deploy-lab.ps1, lab-defaults.json, and README.md that are 100% compliant with the microsoft/MicroHack platform contract."
+name: "Scaffold Lab Automation"
+agent: "agent"
+argument-hint: "Describe the Azure resources this hack needs to deploy (e.g. 'a Storage Account and a Function App for an inventory management scenario')"
+tools: [edit, read, search]
+---
+
+You are scaffolding the `labautomation/` directory for an EMEA MicroHack.
+The user has described what Azure resources the hack needs.
+
+**Do not ask clarifying questions** — infer reasonable defaults and note assumptions in the README.
+
+## Step 1 — Read existing context
+
+Check whether `labautomation/` already exists. If it does, read existing files before overwriting.
+
+## Step 2 — Create lab-defaults.json
+
+Create `labautomation/lab-defaults.json`. Always include the `$schema` field:
+
+```json
+{
+  "$schema": "https://raw.githubusercontent.com/microsoft/MicroHack/refs/heads/main/lab-defaults-schema.json",
+  "groups": [],
+  "deploymentType": "resourcegroup",
+  "labsPerSubscription": 4,
+  "preferredLocation": "westeurope, swedencentral, norwayeast",
+  "estimatedDailyCostsUsd": 5.0
+}
+```
+
+Adjust `deploymentType`, `preferredLocation`, and `estimatedDailyCostsUsd` to match the hack's needs.
+Add `"GHCPUsers"` or `"M365-E5-Users"` to `groups` only if the hack requires those licenses.
+
+## Step 3 — Create deploy-lab.ps1
+
+Create `labautomation/deploy-lab.ps1` following the **exact** platform parameter contract:
+
+```powershell
+param(
+    [Parameter(Mandatory=$true)]
+    [ValidateSet('subscription','resourcegroup','resourcegroup-with-subscriptionowner')]
+    [string]$DeploymentType,
+
+    [Parameter(Mandatory=$true)]
+    [string]$SubscriptionId,
+
+    [string]$ResourceGroupName = "",
+
+    [string[]]$PreferredLocation = @(),
+
+    [string[]]$AllowedEntraUserIds = @()
+)
+```
+
+**Critical rules — the platform silently skips the script if these are violated:**
+- Do NOT call `Connect-AzAccount` — Az context is pre-set by the platform
+- Do NOT call `New-AzResourceGroup` for `resourcegroup` deployments — the RG is pre-created
+- For `subscription` deployments: use `Get-MhhStableHash $AllowedEntraUserIds -Length 24` for deterministic RG naming, then call `New-AzResourceGroup`
+- Always emit at least one `@{ HackboxCredential = @{ name = ...; value = ...; note = ... } }` to the output stream
+
+Add the actual resource deployments (Bicep, ARM, or Az cmdlets) in the body.
+Reference the Bicep/ARM template file relative to `$scriptPath = Split-Path -Parent $MyInvocation.MyCommand.Definition`.
+
+## Step 4 — Create README.md
+
+Create `labautomation/README.md` covering:
+- What the script deploys (bullet list of resources)
+- `deploymentType` choice and reason
+- `preferredLocation` choice and reason
+- `estimatedDailyCostsUsd` basis
+- Any assumptions made during scaffolding
+
+## Step 5 — Self-validate
+
+After creating all files, verify against the compliance checklist:
+- Directory named exactly `labautomation` (no dashes) ✅
+- `lab-defaults.json` has `$schema` field ✅
+- `deploy-lab.ps1` parameter block matches contract exactly ✅
+- No `Connect-AzAccount` in the script ✅
+- No `New-AzResourceGroup` for resourcegroup deployment type ✅
+- At least one `HackboxCredential` returned ✅
+- No hard-coded environment assumptions ✅
+
+Report any item you could not satisfy and why.

03-Azure/01-04-AI/02_Inventory_Planning_Fabric/.gitignore

@@ -0,0 +1,19 @@
+# Lab-provisioned credentials — never commit
+labautomation/lab-defaults.local.json
+
+# Azure session artifacts
+.azure/
+*.log
+
+# VS Code local settings
+.vscode/settings.json
+.vscode/launch.json
+
+# OS
+Thumbs.db
+desktop.ini
+.DS_Store
+
+# Diagram build artifacts — only the rendered PNG (images/architecture.png) is committed
+images/render/
+images/architecture.excalidraw