Repository navigation
Fix: added walkthrough to make the lab visible on the console - #452
Merged
Merged
Conversation
Resolve five gaps found when reviewing labautomation against the MicroHack platform conventions. 1. Participant RBAC missed half the lab. The resource group holds a hub AND a spoke of Foundry, Key Vault, Log Analytics and App Insights, but grants were discovered with `Get-AzResource ... | Select-Object -First 1`, so only one of each pair was ever granted. Grants are now driven off the template's own resource-ID outputs (added to resources.bicep) via a table-driven engine that covers both hub and spoke. Also removes a `continue` that skipped every remaining grant for a user once an existing Cosmos role assignment was found. 2. RBAC failures were swallowed as [WARN], handing attendees a lab whose notebooks silently 403. Grants are now classified Required/Optional; any failed Required grant throws with a per-scope summary. Cosmos data-plane grants check the REST status explicitly, since Invoke-AzRestMethod does not throw on HTTP errors. 3. Add shared-deploy-lab.ps1 to register the ten required resource providers once per subscription. Participants hold only RG-Owner plus subscription Reader, so they cannot self-register and deployment fails with MissingSubscriptionRegistration. Registration is best-effort by design: the platform runs no labs at all if this hook throws. 4. Implement the advertised `subscription` deployment type, which previously fell through with an empty resource group name. 5. Correct estimatedDailyCostsUsd 15.0 -> 32.0. APIM Standard v2 alone is ~23 USD/day; the old figure would have under-sized Console budgets by half. Also: gate region-fallback retries on Test-MhhDeploymentFailureRetryable so a template or permission bug surfaces its real error instead of being retried in every region; drop the declared-but-unused principalId/principalType params from resources.bicep; delete dead resource-name computation in deploy-lab.ps1 that disagreed with the names Bicep actually generates; regenerate resources.json. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: 05a828d3-c050-4705-9340-6c65646dfb58
The workshop provisions the hub with `azd up` and then requires a separate
`scripts/deploy-spoke-foundry.ps1` run that creates its own spoke resource
group (workshop step 3.7). MicroHack gives each participant exactly one
resource group, so the spoke already lives in infra/resources.bicep alongside
the hub. Auditing that port against the original script surfaced two gaps that
only bite in challenge 7:
- The Foundry PROJECT managed identity had no AcrPull on the spoke ACR. The
workshop assigns it ("Assigning AcrPull to Foundry project managed identity")
and notebook 7 explicitly documents it as a prerequisite of the spoke
deployment. Without it the hosted agent version deploys and then fails to
start with an image-pull error. Added as a role assignment in the template,
since it is service-to-service rather than participant RBAC.
- The ACR had adminUserEnabled: true. The workshop creates it with
--admin-enabled false, notebook 7 builds with `az acr build` (cloud build, no
local Docker) and the agent pulls with its managed identity, so admin
credentials are never used. Nothing reads listCredentials. Disabled.
Also grant participants 'Azure AI Project Manager' on the spoke Foundry
account, as the workshop does. Challenges 7-9 manage agents and hosted-agent
versions through the project data plane, which RG-Owner does not cover (Owner
grants actions:* but no dataActions). Kept as its own Optional RBAC target so a
tenant that restricts the role fails challenges 7-9 rather than blocking the
core provision.
Document the full workshop-step-to-resource mapping in the README so the
missing 3.7 step is not mistaken for missing functionality.
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
Copilot-Session: 05a828d3-c050-4705-9340-6c65646dfb58
Reviewed challenges/ against 99-MicroHack-Template and the five sibling labs in
01-04-AI.
Kept, after verifying they are load-bearing rather than leftovers:
challenges/workshop/ the 9 notebooks (the lab content)
challenges/shared/ notebooks do `sys.path.insert(1, '../shared')`
challenges/bicep/ notebooks deploy `../bicep/infra/llm-backend-onboarding`
and `../bicep/infra/citadel-access-contracts` themselves
challenges/azure.yaml azd project-root marker; the notebooks read config via
`azd env get-value`, and setup-notebook-env.ps1 fails
fast without it
These reproduce the upstream repo layout inside challenges/ because the
notebooks are unmodified and use relative paths. Documented as such so the
nesting is not "tidied up" later and silently breaks 7 of 9 challenges.
Fixed:
- Add walkthrough/challenge-0N/solution-0N.md for all nine challenges, the
structure the template mandates and every sibling lab has. Stubs are
pre-populated with the challenge's own success criteria, the reference
notebook, and coach TODO sections; narratives still to be written.
- Add challenges/finish.md (template convention) with wrap-up, the soft-delete
purge commands for APIM/Foundry/Key Vault, and further reading.
- Guard the workshop spoke deployment. challenges/workshop/readme.md, which the
module README sends participants to, instructs `azd up` plus
scripts/deploy-spoke-foundry.* — which would create a SECOND resource group,
contradicting the single-RG design and producing resources whose names do not
match the lab dashboard. Added a caution banner to that readme and a runtime
guard to both deploy-spoke-foundry.ps1 and .sh: they now explain the situation
and exit 0 unless -Force / --force is passed. Kept runnable for use outside
the MicroHack, since notebook 7 and the guide still reference them.
- Repair challenges/azure.yaml. Its `services:` block pointed at
./src/usage-ingestion-logicapp, which is not vendored here, so any azd command
touching services failed on a non-existent path. Removed the block and
documented why the file must stay.
- Rewrite the README "Repository layout" section, which still described
reference/ai-hub-gateway-solution-accelerator/ (deleted during the migration)
and omitted bicep/, shared/, azure.yaml and walkthrough/. Added the
template's "Solutions - spoiler warning" index.
Verified: all 141 relative links in authored files resolve. The 25 remaining
broken links are pre-existing, all inside vendored upstream files, and point at
upstream folders (guides/, validation/, test/, .devcontainer/) that were not
vendored into this module.
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
Copilot-Session: 05a828d3-c050-4705-9340-6c65646dfb58
The folder collided with the existing 05_Claims_Processing module: two sibling labs both numbered 05. 06 was the next free index. Used git mv so history follows the files. Updated the two path references (the 01-04-AI catalog entry and the module README's layout diagram), and reordered the catalog so the entries run 01..06 again rather than listing 06 before 05. Verified after the move: all 141 relative links in authored files resolve, the catalog's links resolve, all four PowerShell scripts parse, lab-defaults.json is valid, and the Bicep template still builds. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: 05a828d3-c050-4705-9340-6c65646dfb58
…ai-governance-lab-automation Fix AI Governance lab automation, align module structure, renumber to 06
Marco Weber (qxsch)
approved these changes
Aug 27, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
No description provided.