fix: main to dev - downmerge - Update CODEOWNERS and improve ACR image build scripts

README.md

@@ -113,7 +113,7 @@ either by deleting the resource group in the Portal or running `azd down`.
 | [Microsoft Foundry](https://learn.microsoft.com/en-us/azure/ai-foundry) | Used to orchestrate and build AI workflows that combine Azure AI services. | Free Tier | [Pricing](https://azure.microsoft.com/pricing/details/ai-studio/) |
 | [Foundry IQ](https://learn.microsoft.com/en-us/azure/search/search-what-is-azure-search) | Powers vector-based semantic search for retrieving indexed conversation data. | Standard S1; costs scale with document count and replica/partition settings. | [Pricing](https://azure.microsoft.com/pricing/details/search/) |
 | [Azure Storage Account](https://learn.microsoft.com/en-us/azure/storage/common/storage-account-overview) | Stores transcripts, intermediate outputs, and application assets. | Standard LRS; usage-based cost by storage/operations. | [Pricing](https://azure.microsoft.com/pricing/details/storage/blobs/) |
-| [Azure AI Services (OpenAI)](https://learn.microsoft.com/en-us/azure/cognitive-services/openai/overview) | Enables language understanding, summarization, entity extraction, and chat capabilities using GPT models. | S0 Tier; pricing depends on token volume and model used (e.g., GPT-4o-mini). | [Pricing](https://azure.microsoft.com/pricing/details/cognitive-services/) |
+| [Azure AI Services (OpenAI)](https://learn.microsoft.com/en-us/azure/cognitive-services/openai/overview) | Enables language understanding, summarization, entity extraction, and chat capabilities using GPT models. | S0 Tier; pricing depends on token volume and model used (e.g., GPT-5.2). | [Pricing](https://azure.microsoft.com/pricing/details/cognitive-services/) |
 | [Azure App Service](https://learn.microsoft.com/en-us/azure/app-service/overview) | Hosts the front-end web application and backend API as Linux web apps. | Basic B3 (non-WAF) or Premium P1v3 (WAF); fixed cost based on plan tier. | [Pricing](https://azure.microsoft.com/pricing/details/app-service/linux/) |
 | [Azure Monitor / Log Analytics](https://learn.microsoft.com/en-us/azure/azure-monitor/logs/log-analytics-overview) | Collects and analyzes telemetry and logs from services and containers. | Pay-as-you-go; charges based on data ingestion volume. | [Pricing](https://azure.microsoft.com/pricing/details/monitor/) |
 | [Azure SQL Database](https://learn.microsoft.com/en-us/azure/azure-sql/database/sql-database-paas-overview) | Stores structured data including insights, metadata, and indexed results. | General Purpose Tier; can be provisioned or serverless. Fixed cost if provisioned. | [Pricing](https://azure.microsoft.com/pricing/details/azure-sql-database/single/) |

azure.yaml

@@ -19,6 +19,9 @@ hooks:
         Write-Host "Web app URL: "
         Write-Host "$env:WEB_APP_URL" -ForegroundColor Cyan
 
+        Write-Host "`nRun the following command in your Bash terminal to build the backend and frontend container images, push them to the provisioned Azure Container Registry, and update the App Services to use them:"
+        Write-Host "bash ./infra/scripts/build_and_push_images.sh" -ForegroundColor Cyan
+
         Write-Host "`nCreate and activate a virtual environment if not already done, then run the following command in the bash terminal to create agents:"
         Write-Host "bash ./infra/scripts/run_create_agents_scripts.sh" -ForegroundColor Cyan
         Write-Host "`nRun the following command in your Bash terminal. It will grant the necessary permissions between resources and your user account, and also process and load the sample data into the application."
@@ -31,6 +34,9 @@ hooks:
         echo "Web app URL: "
         echo $WEB_APP_URL
 
+        echo "\nRun the following command in your Bash terminal to build the backend and frontend container images, push them to the provisioned Azure Container Registry, and update the App Services to use them:"
+        echo "bash ./infra/scripts/build_and_push_images.sh"
+
         echo "\nCreate and activate a virtual environment if not already done, then run the following command in the bash terminal to create agents:"
         echo "bash ./infra/scripts/run_create_agents_scripts.sh"
         echo ""

documents/AzureGPTQuotaSettings.md

@@ -5,6 +5,6 @@
 3. **Go to** the `Management Center` from the bottom-left navigation menu.  
 4. Select `Quota`  
    - Click on the `GlobalStandard` dropdown.  
-   - Select the required **GPT model** (`GPT-4, GPT-4o, GPT-4o Mini`) or **Embeddings model** (`text-embedding-3-small`).  
+   - Select the required **GPT model** (`gpt-5.2`) or **Embeddings model** (`text-embedding-3-small`).  
    - Choose the **region** where the deployment is hosted.  
 5. Request More Quota or delete any unused model deployments as needed.  

documents/CustomizingAzdParameters.md

@@ -12,21 +12,19 @@ By default this template will use the environment name as the prefix to prevent
 | `AZURE_LOCATION`                          | string  | ` `            | Sets the Azure region for resource deployment.                             |
 | `AZURE_ENV_NAME`                          | string  | `env_name`               | Sets the environment name prefix for all Azure resources.                  |
 | `AZURE_ENV_AI_SERVICE_LOCATION`                | string  | `eastus2`                | Specifies the Azure AI service location.                                        |
-| `AZURE_ENV_SECONDARY_LOCATION`                | string  | `eastus2`                | Specifies a secondary Azure region.                                        |
-| `AZURE_ENV_MODEL_DEPLOYMENT_TYPE`     | string  | `GlobalStandard`         | Defines the model deployment type (allowed: `Standard`, `GlobalStandard`). **Note:** The `azd` location-picker filters regions using the `usageName` metadata on `aiServiceLocation` in `infra/main.bicep` (currently `OpenAI.GlobalStandard.gpt-4o-mini,150`). If you set this to `Standard`, also edit that metadata to `OpenAI.Standard.gpt-4o-mini,150` so the picker shows the correct subset of regions, since `gpt-4o-mini` Standard (regional) availability differs from Global Standard. |
-| `AZURE_ENV_GPT_MODEL_NAME`          | string  | `gpt-4o-mini`            | Specifies the GPT model name (e.g., `gpt-4o-mini`, `gpt-4.1`, etc.).               |
-| `AZURE_ENV_GPT_MODEL_VERSION`                 | string  | `2024-07-18`             | Sets the Azure model version (e.g., `2024-07-18`, etc.).                |
+| `AZURE_ENV_SECONDARY_LOCATION`                | string  | `australiaeast`                | Specifies a secondary Azure region.                                        |
+| `AZURE_ENV_MODEL_DEPLOYMENT_TYPE`     | string  | `GlobalStandard`         | Defines the model deployment type (allowed: `Standard`, `GlobalStandard`). **Note:** The `azd` location-picker filters regions using the `usageName` metadata on `aiServiceLocation` in `infra/main.bicep` (currently `OpenAI.GlobalStandard.gpt-5.2,150`). If you set this to `Standard`, also edit that metadata to `OpenAI.Standard.gpt-5.2,150` so the picker shows the correct subset of regions, since `gpt-5.2` Standard (regional) availability differs from Global Standard. |
+| `AZURE_ENV_GPT_MODEL_NAME`          | string  | `gpt-5.2`            | Specifies the GPT model name (e.g., `gpt-5.2`, `gpt-4.1`, etc.).               |
+| `AZURE_ENV_GPT_MODEL_VERSION`                 | string  | `2025-12-11`             | Sets the Azure model version (e.g., `2025-12-11`, etc.).                |
 | `AZURE_ENV_GPT_MODEL_CAPACITY` | integer | `30`                     | Sets the GPT model capacity.                                               |
 | `AZURE_ENV_EMBEDDING_MODEL_NAME`            | string  | `text-embedding-3-small` | Sets the name of the embedding model to use.                               |
-| `AZURE_ENV_IMAGE_TAG`                      | string  | `latest_afv2`        | Sets the image tag (`latest_afv2`, `dev`, `hotfix`, etc.).   |
+| `AZURE_ENV_IMAGE_TAG`                      | string  | `latest`        | Sets the image tag (`latest`, `dev`, `hotfix`, etc.).   |
 | `AZURE_ENV_EMBEDDING_DEPLOYMENT_CAPACITY`   | integer | `80`                     | Sets the capacity for the embedding model deployment.                      |
 | `AZURE_ENV_EXISTING_LOG_ANALYTICS_WORKSPACE_RID`    | string  | Guide to get your [Existing Workspace ID](/documents/re-use-log-analytics.md)            | Reuses an existing Log Analytics Workspace instead of creating a new one.  |
-| `USE_LOCAL_BUILD`    | string  | `false`           | Indicates whether to use a local container build for deployment.  |
 | `AZURE_EXISTING_AIPROJECT_RESOURCE_ID`    | string  | `<Existing AI Project resource Id>`            | Reuses an existing AIFoundry and AIFoundryProject instead of creating a new one.  |
 | `AZURE_ENV_VM_ADMIN_USERNAME`  | string | `take(newGuid(), 20)`               | The administrator username for the virtual machine.         |
 | `AZURE_ENV_VM_ADMIN_PASSWORD`  | string | `newGuid()`               | The administrator password for the virtual machine.         |
 | `AZURE_ENV_VM_SIZE`  | string | `Standard_D2s_v5`               | The size/SKU of the Jumpbox Virtual Machine (e.g., `Standard_D2s_v5`, `Standard_DS2_v2`).         |
-| `AZURE_ENV_CONTAINER_REGISTRY_ENDPOINT`  | string | `<Container Registry Endpoint>`               | The hostname/endpoint for the container registry used by both backend and frontend containers.         |
 
 
 ## How to Set a Parameter

documents/DeploymentGuide.md

@@ -289,7 +289,7 @@ azd up
 **During deployment, you'll be prompted for:**
 1. **Environment name** (e.g., "ckmapp") - Must be 3-16 characters long, alphanumeric only
 2. **Azure subscription** selection
-3. **Microsoft Foundry deployment region** - Select a region with available gpt-4o model quota for AI operations
+3. **Microsoft Foundry deployment region** - Select a region with available gpt-5.2 model quota for AI operations
 4. **Primary location** - Select the region where your infrastructure resources will be deployed
 5. **Resource group** selection (create new or use existing)
 6. **Use case** selection:
@@ -312,9 +312,39 @@ After successful deployment:
 4. Click on the App Service to open its overview page
 5. Copy the **Default domain** URL (e.g., `app-abc123def.azurewebsites.net`)
 
-⚠️ **Important:** Complete the following steps to process sample data and configure authentication before accessing the application.
+⚠️ **Important:** Complete the following steps to build the application container images, process sample data, and configure authentication before accessing the application.
 
-### 4.4 Process Sample Data
+### 4.4 Build and Push Container Images
+
+This solution provisions a dedicated **Azure Container Registry (ACR)** in your resource group. During provisioning, the backend and frontend App Services start with a temporary *hello-world* placeholder image. Run the following script to build the backend (`km-api`) and frontend (`km-app`) images, push them to your ACR, and update the App Services to run them.
+
+**Run the build and push script:**
+
+The `azd up` deployment output includes a ready-to-use bash script command. Look for the script in the deployment output and run it:
+
+```bash
+bash ./infra/scripts/build_and_push_images.sh
+```
+
+The images are **built remotely in ACR** using `az acr build`, so no local Docker installation is required.
+
+**If you don't have `azd env` configured**, pass the resource group name so the script can resolve values from the deployment outputs:
+
+```bash
+bash ./infra/scripts/build_and_push_images.sh <resource-group>
+```
+
+**What the script does:**
+- Builds the backend image from [src/api/ApiApp.Dockerfile](../src/api/ApiApp.Dockerfile)
+- Builds the frontend image from [src/App/WebApp.Dockerfile](../src/App/WebApp.Dockerfile)
+- Pushes both images to the provisioned Azure Container Registry
+- Updates the backend and frontend App Services to run the new images (pulled via managed identity) and restarts them
+
+> **Note:** For Production (WAF) deployments, ACR public network access is disabled. The script temporarily enables it to build/push the images and restores the original setting when it finishes.
+
+**Expected Processing Time:** 5-10 minutes depending on network speed.
+
+### 4.5 Process Sample Data
 
 After the infrastructure deployment completes, follow these steps to process and load the sample data:
 

documents/QuotaCheck.md

@@ -14,7 +14,7 @@ az login --use-device-code
 
 ### 📌 Default Models & Capacities:
 ```
-gpt-4o:150, gpt-4o-mini:150, gpt-4:150, text-embedding-3-small:80
+gpt-5.2:150, text-embedding-3-small:80
 ```
 ### 📌 Default Regions:
 ```
@@ -40,19 +40,19 @@ eastus, eastus2, australiaeast, uksouth, swedencentral, westus, westus3, japanea
    ```
 ✔️ Check specific model(s) in default regions:
   ```
-  ./quota_check_params.sh --models gpt-4o:150,text-embedding-3-small:80
+  ./quota_check_params.sh --models gpt-5.2:150,text-embedding-3-small:80
   ```
 ✔️ Check default models in specific region(s):
   ```
 ./quota_check_params.sh --regions eastus,westus
   ```
 ✔️ Passing Both models and regions:  
   ```
-  ./quota_check_params.sh --models gpt-4o:150 --regions eastus,westus2
+  ./quota_check_params.sh --models gpt-5.2:150 --regions eastus,westus2
   ```
 ✔️ All parameters combined:
   ```
- ./quota_check_params.sh --models gpt-4:150,text-embedding-3-small:80 --regions eastus,westus --verbose
+ ./quota_check_params.sh --models gpt-5.2:150,text-embedding-3-small:80 --regions eastus,westus --verbose
   ```
 
 ### **Sample Output**

documents/re-use-foundry-project.md

@@ -5,7 +5,7 @@ To configure your environment to use an existing Microsoft Foundry Project, foll
 
 > **⚠️ Region requirement**
 >
-> The existing Foundry project must reside in a region that supports **both** the GPT model deployed by this accelerator (default `gpt-4o-mini` with `GlobalStandard` deployment type) **and** Azure AI Content Understanding (GA).<br>
+> The existing Foundry project must reside in a region that supports **both** the GPT model deployed by this accelerator (default `gpt-5.2` with `GlobalStandard` deployment type) **and** Azure AI Content Understanding (GA).<br>
 > Supported regions: `australiaeast`, `eastus`, `eastus2`, `japaneast`, `southcentralus`, `swedencentral`, `uksouth`, `westeurope`, `westus`, `westus3`.<br>
 > If the existing project is in a different region, deployment will fail or the application will not work correctly.