CI/CD, policy as code, and controlled promotion

Chapter 3 of 6

Complete these items before facilitated work:

• An approved release control set can be inspected: release metadata binds one commit to the immutable agent, APIM policy, evaluation inputs, and Bicep parameters; the quality owner can retrieve a passing release-gate result; the security owner can retrieve the matching adversarial result; and the observability owner can run the smoke check. (The governed-agent, APIM, MCP security, evaluation, threat-defense, observability, and promotion controls establish these prerequisites.)
• Use the approved repository and protected default branch. Select an approved 40-character SHA reachable from that branch; do not store the selected SHA in its own commit.
• Confirm that release metadata binds that SHA to the prompt, immutable agent version, model alias, APIM policy, evaluation inputs, and both environment parameter files.
• Confirm the evaluation release policy is enabled. Its temporary external baseline and candidate records must match the policy run IDs. The candidate passes, and the generated tool-process self-test returns BLOCK.
• Retrieve the confirmed security-release-attestation into the approved temporary workspace. It must match the release agent and baseline/remediated versions, include external authorization and report locations, show lower aggregate attack success and per-risk non-regression, record prohibited actions at zero attack success, and contain no payload.
• Confirm the smoke check scripts check the same commit and live Application Insights workspace binding. The result must use distinct normal and failure trace IDs, wait for stable ingestion, separate tool and model failures, report no sensitive input, and retain no payload.
• Have the unit-check, routing, release/security-store, and parameter-file owners accept their files. The delivery owner records those decisions.
• Have the agent owner approve the framework and runtime path for the release agent, and have the portfolio owner finish the duplicate review against the enterprise agent inventory. Bring the reviewed inventory record and the deciding role.

The protected nonproduction environment holds session12_SMOKE_URL, session12_SMOKE_FAILURE_URL, session12_AI_RESOURCE_ID, session12_LOG_ANALYTICS_WORKSPACE_ID, and the session12_SMOKE_BEARER_TOKEN secret. Optional timeout and retry variables override the 180-second and 15-second defaults.

Configure nonproduction-preview, nonproduction, production-preview, and production. Both apply environments require reviewers and prevent self-review. Production also restricts deployment refs and disables administrator bypass. Native secret scanning and push protection must be enabled.

Each stage service principal has one federated credential for preview and one for apply. Every subject must exactly match the repository's current GitHub OIDC subject and environment. Assign only Contributor, role ID b24988ac-6180-42a0-ab88-20f7382dd24c, at the exact environment resource-group scope. Contributor supports deployment and what-if but cannot assign Azure roles.

For preflight, the GitHub administrator needs repository Administration: read and Secret scanning alerts: read. The Entra administrator gives the operator temporary Directory Readers at tenant scope. The operator also needs temporary Contributor at both exact resource-group scopes for what-if. Expire or remove this human access after the ready check. The workload identities keep their scoped Contributor assignments.

The release/security-store interface must retrieve the temporary evaluation and security records and support Stage, Approve, and Retrieve by exact release ID and SHA-256. Retrieve must never return a staged record as a restore target.

Implementation files#