diff --git a/.github/PULL_REQUEST_TEMPLATE.md b/.github/PULL_REQUEST_TEMPLATE.md index bd6bfe6..e977bc3 100644 --- a/.github/PULL_REQUEST_TEMPLATE.md +++ b/.github/PULL_REQUEST_TEMPLATE.md @@ -1,14 +1,14 @@ ## What I built -- Bicep entry template: `main.bicep` (params, `@secure()`, module call, outputs) -- Storage module: `modules/storage.bicep` (storage account + nested blob container) +- Bicep entry template: `main.bicep` (params incl. `environment`, `@secure()`, module call, outputs) +- Storage module: `modules/storage.bicep` (storage account + nested `raw` and `curated` containers, Environment tag) - Deploy evidence: `docs/deploy_succeeded.txt`, `docs/what_if.txt`, `docs/portal_confirm.md` - Teammate write-up: `WRITEUP.md` - AI usage: `AI_ASSIST.md` - (Optional) extras under `docs/optional/` ## How to review -- Bicep: read `main.bicep` and `modules/storage.bicep` (param / output / `@secure()` / module / nested container). -- Evidence: `docs/deploy_succeeded.txt` shows `Succeeded`; `docs/what_if.txt` is real CLI output; `docs/portal_confirm.md` names the account + container. +- Bicep: read `main.bicep` and `modules/storage.bicep` (param / output / `@secure()` / module / both nested containers). +- Evidence: `docs/deploy_succeeded.txt` shows `Succeeded`; `docs/what_if.txt` is real CLI output; `docs/portal_confirm.md` names the account, both containers, and the teardown line. - Write-ups: `WRITEUP.md` and `AI_ASSIST.md`. ## How to run @@ -21,13 +21,15 @@ az bicep version || az bicep install bash .hyf/test.sh ``` -Deploy (example — use your own globally unique storage name and never commit the secure value): +Deploy (example: use your own globally unique storage name and never commit the secure value). +This is the post-Task-1 shape; drop `environment=dev` if you have not added that parameter yet, +because Azure rejects a parameter the template does not declare: ```bash az deployment group create \ --resource-group "$CLASS_RG" \ --template-file main.bicep \ - --parameters storageName= dummySecret=not-a-real-secret + --parameters storageName= environment=dev dbAdminPassword=not-a-real-secret ``` Prerequisite: you can write into `$CLASS_RG` with the HYF student IaC role. @@ -35,7 +37,7 @@ Prerequisite: you can write into `$CLASS_RG` with the HYF student IaC role. ## What reviewers should see (expected results) Fill in what your deploy actually produced: - Storage account name: -- Blob container name: +- Blob container names: - `provisioningState` in `docs/deploy_succeeded.txt`: - `bash .hyf/test.sh` score: - Teardown: @@ -46,7 +48,7 @@ Fill in what your deploy actually produced: ## Self-check - [ ] `bash .hyf/test.sh` passes -- [ ] Storage account **and** nested blob container exist(ed) in `$CLASS_RG` +- [ ] Storage account **and** both nested blob containers (`raw`, `curated`) exist(ed) in `$CLASS_RG` - [ ] `@secure()` present; no credentials / `.env` / `*.parameters.json` committed - [ ] `docs/what_if.txt` is real CLI output (not a paraphrase) -- [ ] Resources from this assignment were torn down (or blocked delete documented) +- [ ] Resources from this assignment were torn down, and `docs/portal_confirm.md` records it (or documents the blocked delete) diff --git a/.hyf/test.sh b/.hyf/test.sh index 0ce8202..ef9eab0 100755 --- a/.hyf/test.sh +++ b/.hyf/test.sh @@ -50,12 +50,12 @@ score=$((score + l1)) pass "Level 1: required files ($l1/20 pts)" # ── Level 2 (35 pts): Ch4 baseline kept + extensions ──────────────────────── -# Baseline (20): @secure, module, storageAccounts, ≥1 nested container. -# Extensions (15→20 listed): environment param (5) + tags wiring (5) + curated (10). -# Point math: 20+5+5+10=40 raw; curated is the 10-pt extension and L2 caps at 35 -# by awarding baseline container as required-fail without double-counting past 35: -# awarded = @secure5 + module5 + storage5 + container5 + env5 + tags5 + curated10 -# then min(l2, 35). Fresh starter scores 20/35 (baseline only). +# Baseline (20): @secure 5 + module 5 + storageAccounts 5 + >=1 nested container 5. +# Extensions (15): environment param 5 + tags wiring 5 + curated container 5. +# 20 + 15 = 35 exactly, so there is no cap. That matters: an earlier version +# awarded 40 raw into a 35 cap, which meant dropping any single baseline check +# cost zero points (a tree with no @secure() still scored 35/35 and 100/100). +# Every check below is now load-bearing. Fresh starter scores 20/35 (baseline). l2=0 main="$REPO_ROOT/main.bicep" mod="$REPO_ROOT/modules/storage.bicep" @@ -115,22 +115,21 @@ if [[ "${#bicep_sources[@]}" -gt 0 ]]; then if grep -qhE "['\"]curated['\"]" "${bicep_sources[@]}" 2>/dev/null; then has_curated=true fi - if [[ "$container_count" -ge 2 ]] || [[ "$has_curated" == true ]]; then - l2=$((l2 + 10)); pass "second nested container (curated) present" + # Both conditions required. The string alone used to be enough, so a comment + # like `// TODO: add a container named 'curated'` bought the full extension. + if [[ "$container_count" -ge 2 ]] && [[ "$has_curated" == true ]]; then + l2=$((l2 + 5)); pass "second nested container (curated) present" else fail "need a second nested container named curated (keep raw; Task 2)" fi if [[ "$container_count" -lt 2 ]]; then warn "only $container_count nested container resource(s) — Task 2 expects raw + curated (count >= 2)" + elif [[ "$has_curated" != true ]]; then + warn "found $container_count containers but none named curated — Task 2 asks for raw + curated" fi fi -# Raw check sum can be 40; L2 bucket is 35. -if [[ "$l2" -gt 35 ]]; then - l2=35 -fi - score=$((score + l2)) pass "Level 2: Bicep baseline + extensions ($l2/35 pts)" diff --git a/docs/portal_confirm.md b/docs/portal_confirm.md index 8b8f071..16b805c 100644 --- a/docs/portal_confirm.md +++ b/docs/portal_confirm.md @@ -2,3 +2,7 @@ + +