ci(samples): add basic data-plane validation (#662)

* ci(samples): add basic data-plane validation

Run hosted-agent diagnostics after each ephemeral Bicep deployment so the ADO validation proves deployed data-plane endpoints are reachable from a hosted agent runtime.

The diagnostic step discovers Foundry project endpoints, deploys the checked-in diagnostic agent into the ephemeral resource group, invokes DNS/TCP/TLS/HTTP probes, and fails the job on probe failures.

Authored-by: GitHub Copilot CLI v1.0.65

Model: GPT-5.5 (gpt-5.5)

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

* fix(samples): initialize diagnostic azd environment

Create the azd environment explicitly before setting diagnostic deployment values so CI does not block during hosted-agent diagnostics setup.

Authored-by: GitHub Copilot CLI v1.0.65

Model: GPT-5.5 (gpt-5.5)

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

* fix(samples): install diagnostic azd project extension

Install the azure.ai.projects azd extension before deploying the diagnostic hosted-agent project so azd can resolve the azure.ai.project service host in the checked-in sample.

Authored-by: GitHub Copilot CLI v1.0.65

Model: GPT-5.5 (gpt-5.5)

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

* test(samples): trigger private data-plane validation

Add a harmless marker under the private-network standard agent sample so the ADO PR validation deploys that private sample and runs the new data-plane diagnostics against it.

Authored-by: GitHub Copilot CLI v1.0.65

Model: GPT-5.5 (gpt-5.5)

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

* fix(samples): prefer main bicep params in PR validation

Deploy main.bicepparam for targeted or changed sample validation when present so CI validates the primary sample path instead of auxiliary add-existing-project parameter files that require external resources.

Authored-by: GitHub Copilot CLI v1.0.65

Model: GPT-5.5 (gpt-5.5)

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

* fix(samples): surface private validation blockers

Fail deployment validation immediately when ARM deployments fail instead of continuing inside a conditional shell function. Add the missing ACR private DNS zone key for template 15 and emit an actionable diagnostic error when public access is disabled without private endpoint connectivity from the ADO runner.

Authored-by: GitHub Copilot CLI v1.0.65

Model: GPT-5.5 (gpt-5.5)

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

* ci(samples): skip private hosted diagnostics

Treat private-only Foundry samples as deploy/resource validation on Microsoft-hosted ADO agents. Hosted-agent data-plane diagnostics now skip with a warning unless private endpoint connectivity is explicitly provided, and the temporary README marker used to exercise the private sample is removed.

Authored-by: GitHub Copilot CLI v1.0.65

Model: GPT-5.5 (gpt-5.5)

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

---------

Co-authored-by: kishorebr <kishorebr@microsoft.com>
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Author: 3 people

infrastructure/infrastructure-setup-bicep/15-private-network-standard-agent-setup/main.bicepparam

@@ -34,6 +34,7 @@ param existingDnsZones = {
   'privatelink.search.windows.net': ''           
   'privatelink.blob.core.windows.net': ''                            
   'privatelink.documents.azure.com': ''                       
+  'privatelink.azurecr.io': ''
 }
 
 //DNSZones names for validating if they exist
@@ -70,4 +71,3 @@ param dnsZoneNames = [
 param vnetAddressPrefix = ''
 param agentSubnetPrefix = ''
 param peSubnetPrefix = ''
-