Make app provisioning wait for role assignments and private endpoints by Copilot · Pull Request #14483 · microsoft/aspire

Copilot · 2026-02-13T00:12:54Z

Description

Container apps and web sites can be provisioned before their role assignments and private endpoints are ready, causing connectivity failures on startup. The pipeline ordering didn't enforce that prerequisite infrastructure steps (role assignments, private endpoints) complete before app provisioning steps like provision-{app}-containerapp/provision-{app}-website.

Before: provision-api-website runs concurrently with provision-api-roles-kv

[5] provision-api-roles-kv | provision-env (parallel)
[6] push-prereq
[7] push-api
[8] provision-api-website  ← deployed before roles/PEs are ready

After: provision-api-website depends on provision-api-roles-kv and any private endpoints

[5] provision-api-roles-kv | provision-env (parallel)
[6] push-prereq
[7] push-api
[8] provision-api-website  ← waits for roles and PEs

Approach

Introduced ComputedDeploymentPrerequisitesAnnotation (public) that AzureResourcePreparer attaches to a compute resource after discovering its deployment prerequisites — both role assignment resources and private endpoint resources
Added PrivateEndpointResourceAnnotation (internal) to link Azure resources to their private endpoint resources. AddPrivateEndpoint() annotates the target's root Azure resource, enabling AzureResourcePreparer to discover private endpoints without cross-project type references
AzureContainerAppResource and AzureAppServiceWebSiteResource now query ComputedDeploymentPrerequisitesAnnotation on the target resource to set up pipeline dependencies
This is more robust than string-prefix matching and covers both role assignments and private endpoints
Updated snapshot tests to reflect corrected dependency ordering

Checklist

Is this feature complete?
- Yes. Ready to ship.
- No. Follow-up changes expected.
Are you including unit tests for the changes and scenario tests if relevant?
- Yes
- No
Did you add public API?
- Yes
  - If yes, did you have an API Review for it?
    - Yes
    - No
  - Did you add <remarks /> and <code /> elements on your triple slash comments?
    - Yes
    - No
- No
Does the change make any security assumptions or guarantees?
- Yes
- No
Does the change require an update in our Aspire docs?
- Yes
- No

💬 We'd love your input! Share your thoughts on Copilot coding agent in our 2 minute survey.

github-actions · 2026-02-23T02:14:23Z

🚀 Dogfood this PR with:

⚠️ WARNING: Do not do this without first carefully reviewing the code of this PR to satisfy yourself it is safe.

curl -fsSL https://raw.githubusercontent.com/dotnet/aspire/main/eng/scripts/get-aspire-cli-pr.sh | bash -s -- 14483

Or

Run remotely in PowerShell:

iex "& { $(irm https://raw.githubusercontent.com/dotnet/aspire/main/eng/scripts/get-aspire-cli-pr.ps1) } 14483"

github-actions · 2026-02-23T02:37:56Z

🎬 CLI E2E Test Recordings

The following terminal recordings are available for commit 0bd4173:

Test	Recording
AddPackageInteractiveWhileAppHostRunningDetached	▶️ View Recording
AddPackageWhileAppHostRunningDetached	▶️ View Recording
AgentCommands_AllHelpOutputs_AreCorrect	▶️ View Recording
AgentInitCommand_MigratesDeprecatedConfig	▶️ View Recording
AgentInitCommand_WithMalformedMcpJson_ShowsErrorAndExitsNonZero	▶️ View Recording
AspireUpdateRemovesAppHostPackageVersionFromDirectoryPackagesProps	▶️ View Recording
Banner_DisplayedOnFirstRun	▶️ View Recording
Banner_DisplayedWithExplicitFlag	▶️ View Recording
CreateAndDeployToDockerCompose	▶️ View Recording
CreateAndDeployToDockerComposeInteractive	▶️ View Recording
CreateAndPublishToKubernetes	▶️ View Recording
CreateAndRunAspireStarterProject	▶️ View Recording
CreateAndRunAspireStarterProjectWithBundle	▶️ View Recording
CreateAndRunJsReactProject	▶️ View Recording
CreateAndRunPythonReactProject	▶️ View Recording
CreateAndRunTypeScriptStarterProject	▶️ View Recording
CreateEmptyAppHostProject	▶️ View Recording
CreateStartAndStopAspireProject	▶️ View Recording
CreateStartWaitAndStopAspireProject	▶️ View Recording
CreateTypeScriptAppHostWithViteApp	▶️ View Recording
DescribeCommandResolvesReplicaNames	▶️ View Recording
DescribeCommandShowsRunningResources	▶️ View Recording
DetachFormatJsonProducesValidJson	❌ Upload failed
DoctorCommand_DetectsDeprecatedAgentConfig	❌ Upload failed
DoctorCommand_WithSslCertDir_ShowsTrusted	▶️ View Recording
DoctorCommand_WithoutSslCertDir_ShowsPartiallyTrusted	▶️ View Recording
LogsCommandShowsResourceLogs	▶️ View Recording
PsCommandListsRunningAppHost	▶️ View Recording
PsFormatJsonOutputsOnlyJsonToStdout	▶️ View Recording
SecretCrudOnDotNetAppHost	❌ Upload failed
SecretCrudOnTypeScriptAppHost	▶️ View Recording
StagingChannel_ConfigureAndVerifySettings_ThenSwitchChannels	❌ Upload failed
StopAllAppHostsFromAppHostDirectory	▶️ View Recording
StopAllAppHostsFromUnrelatedDirectory	❌ Upload failed
StopNonInteractiveMultipleAppHostsShowsError	▶️ View Recording
StopNonInteractiveSingleAppHost	▶️ View Recording
StopWithNoRunningAppHostExitsSuccessfully	❌ Upload failed

_{📹 Recordings uploaded automatically from CI run #22641869722}

Copilot

Pull request overview

Ensures Azure app provisioning (Container Apps / App Service Web Sites) waits for role-assignment resources to be provisioned first, preventing startup connectivity failures caused by role assignments not being ready.

Changes:

Introduces ComputedRoleAssignmentsAnnotation and attaches it during Azure resource preparation after role assignment resources are created.
Updates Azure Container App and App Service Web Site provisioning steps to depend on the computed role-assignment resources (instead of name-based matching).
Updates deployment snapshot tests to reflect the corrected dependency ordering.

Reviewed changes

Copilot reviewed 6 out of 6 changed files in this pull request and generated 4 comments.

Show a summary per file

File	Description
tests/Aspire.Hosting.Azure.Tests/Snapshots/AzureDeployerTests.DeployAsync_WithRedisAccessKeyAuthentication_CreatesCorrectDependencies.verified.txt	Snapshot updated to show website provisioning depends on role-assignment steps.
tests/Aspire.Hosting.Azure.Tests/Snapshots/AzureDeployerTests.DeployAsync_WithAzureResourceDependencies_DoesNotHang_step=diagnostics.verified.txt	Snapshot updated to reflect dependency ordering in diagnostics output.
src/Aspire.Hosting.Azure/ComputedRoleAssignmentsAnnotation.cs	Adds public annotation to surface computed role assignment resources to downstream pipeline configuration.
src/Aspire.Hosting.Azure/AzureResourcePreparer.cs	Attaches the computed role assignment annotation after creating role-assignment resources in publish mode.
src/Aspire.Hosting.Azure.AppService/AzureAppServiceWebSiteResource.cs	Makes website provisioning depend on computed role-assignment provisioning steps.
src/Aspire.Hosting.Azure.AppContainers/AzureContainerAppResource.cs	Makes container app provisioning depend on computed role-assignment provisioning steps.

src/Aspire.Hosting.Azure/ComputedRoleAssignmentsAnnotation.cs

src/Aspire.Hosting.Azure.AppService/AzureAppServiceWebSiteResource.cs

src/Aspire.Hosting.Azure.AppContainers/AzureContainerAppResource.cs

src/Aspire.Hosting.Azure/ComputedRoleAssignmentsAnnotation.cs

Copilot · 2026-02-24T21:13:48Z

Just as a heads up, I was blocked by some firewall rules while working on your feedback. Expand below for details.

Warning

Firewall rules blocked me from connecting to one or more addresses (expand for details)

I tried to connect to the following addresses, but was blocked by firewall rules:

aka.ms
- Triggering command: /usr/local/bin/bicep /usr/local/bin/bicep build /tmp/aspire-bicep1sm8Os/env-acr.module.bicep --stdout (dns block)
- Triggering command: /usr/local/bin/bicep /usr/local/bin/bicep build /tmp/aspire-biceppgOY5w/kv.module.bicep --stdout (dns block)
- Triggering command: /usr/local/bin/bicep /usr/local/bin/bicep build /tmp/aspire-bicepdZBha6/api-identity.module.bicep --stdout (dns block)

If you need me to access, download, or install something from one of these locations, you can either:

Configure Actions setup steps to set up my environment, which run before the firewall is enabled
Add the appropriate URLs or hosts to the custom allowlist in this repository's Copilot coding agent settings (admins only)

eerhardt · 2026-03-03T20:59:17Z

@davidfowl - I believe this is ready for review now.

eerhardt · 2026-03-03T21:00:28Z

...eployerTests.DeployAsync_WithMultipleComputeEnvironments_Works_step=diagnostics.verified.txt

@@ -29,26 +29,26 @@ Steps with no dependencies run first, followed by steps that depend on them.
 13. login-to-acr-aca-env-acr
 14. push-prereq
 15. push-api-service
- 16. update-api-service-provisionable-resource


FYI - this test is currently broken (quarantined). This baseline change wasn't caused by my changes, but I'm putting it here so the test passes.

eerhardt · 2026-03-03T21:01:26Z

tests/Aspire.Hosting.Azure.Tests/AzureDeployerTests.cs

@@ -124,7 +124,6 @@ public async Task DeployAsync_PromptsViaInteractionService()
    /// the containers and does not attempt to push them.
    /// </summary>
    [Fact]
-    [RequiresTools(["az"])] // Requires Azure CLI to compile Bicep templates


I changed these tests to use a the ProvisioningTestHelpers.CreateBicepCompiler(), which mocks out compiling bicep. It speeds the tests up tremendously.

eerhardt · 2026-03-03T21:02:22Z

tests/Aspire.Hosting.Azure.Tests/AzureDeployerTests.cs

@@ -569,7 +565,7 @@ public async Task DeployAsync_WithUnresolvedParameters_PromptsForParameterValues
        ConfigureTestServices(builder, interactionService: testInteractionService, bicepProvisioner: new NoOpBicepProvisioner());

        // Add a parameter that will be unresolved
-        var param = builder.AddParameter("test-param");
+        var param = builder.AddParameter("unresolved-test-param");


This is necessary because there is another test using this same parameter name, and saving a value into the deployment state file. Having a value in the deployment state file causes this test to hang.

The easy fix was to use a different parameter name.

src/Aspire.Hosting.Azure.AppContainers/ContainerAppEnvironmentContext.cs

…#14483) * Make app provisioning wait for role assignments and private endpoints * Update code to use DeploymentPrerequisitesAnnotation * Add private endpoints to tests --------- Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com> Co-authored-by: Eric Erhardt <eric.erhardt@microsoft.com>

Copilot AI assigned Copilot and eerhardt Feb 13, 2026

Copilot started work on behalf of eerhardt February 13, 2026 00:13 View session

Copilot AI changed the title ~~[WIP] Fix app provisioning order for resource dependencies~~ Make app provisioning wait for role assignments and private endpoints Feb 13, 2026

Copilot AI requested a review from eerhardt February 13, 2026 00:28

Copilot finished work on behalf of eerhardt February 13, 2026 00:28

This was referenced Feb 19, 2026

[13.2-burndown] Daily Burndown Report - February 19, 2026 📊 #14581

Closed

[13.2-burndown] Daily Burndown Report - February 20, 2026 📊 #14594

Closed

[13.2-burndown] Daily Burndown Report - February 22, 2026 #14608

Closed

davidfowl marked this pull request as ready for review February 23, 2026 02:39

Copilot AI review requested due to automatic review settings February 23, 2026 02:39

Copilot started reviewing on behalf of davidfowl February 23, 2026 02:39 View session

Copilot AI reviewed Feb 23, 2026

View reviewed changes

eerhardt reviewed Feb 24, 2026

View reviewed changes

src/Aspire.Hosting.Azure/ComputedRoleAssignmentsAnnotation.cs Outdated Show resolved Hide resolved

Copilot started work on behalf of eerhardt February 24, 2026 20:56 View session

Copilot AI requested a review from eerhardt February 24, 2026 21:13

Copilot finished work on behalf of eerhardt February 24, 2026 21:14

Make app provisioning wait for role assignments and private endpoints

6f16e97

eerhardt force-pushed the copilot/fix-provisioning-order-apps branch from e2776ab to 6f16e97 Compare March 3, 2026 16:40

eerhardt added 2 commits March 3, 2026 13:58

Update code to use DeploymentPrerequisitesAnnotation

592d072

Add private endpoints to tests

0bd4173

eerhardt requested review from davidfowl and mitchdenny March 3, 2026 20:59

eerhardt reviewed Mar 3, 2026

View reviewed changes

davidfowl reviewed Mar 4, 2026

View reviewed changes

src/Aspire.Hosting.Azure.AppContainers/ContainerAppEnvironmentContext.cs Show resolved Hide resolved

davidfowl approved these changes Mar 4, 2026

View reviewed changes

eerhardt merged commit 7ff60b7 into release/13.2 Mar 4, 2026
758 of 761 checks passed

eerhardt deleted the copilot/fix-provisioning-order-apps branch March 4, 2026 16:30

dotnet-policy-service bot added this to the 13.2 milestone Mar 4, 2026

eerhardt mentioned this pull request Mar 4, 2026

Apps need to wait to be provisioned until all the roles, private endpoints, etc of their references are provisioned #14482

Closed

github-actions bot mentioned this pull request Mar 5, 2026

[13.2-burndown] Daily Burndown Report - March 5, 2026 #14972

Closed

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Make app provisioning wait for role assignments and private endpoints#14483

Make app provisioning wait for role assignments and private endpoints#14483
eerhardt merged 3 commits intorelease/13.2from
copilot/fix-provisioning-order-apps

Copilot AI commented Feb 13, 2026 •

edited

Loading

Uh oh!

github-actions bot commented Feb 23, 2026 •

edited

Loading

Uh oh!

github-actions bot commented Feb 23, 2026 •

edited

Loading

Uh oh!

Copilot AI left a comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Copilot AI commented Feb 24, 2026

I tried to connect to the following addresses, but was blocked by firewall rules:

Uh oh!

eerhardt commented Mar 3, 2026

Uh oh!

eerhardt Mar 3, 2026

Uh oh!

eerhardt Mar 3, 2026

Uh oh!

eerhardt Mar 3, 2026

Uh oh!

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

Conversation

Copilot AI commented Feb 13, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Description

Approach

Checklist

Uh oh!

github-actions bot commented Feb 23, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions bot commented Feb 23, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

🎬 CLI E2E Test Recordings

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Copilot AI commented Feb 24, 2026

I tried to connect to the following addresses, but was blocked by firewall rules:

Uh oh!

eerhardt commented Mar 3, 2026

Uh oh!

eerhardt Mar 3, 2026

Choose a reason for hiding this comment

Uh oh!

eerhardt Mar 3, 2026

Choose a reason for hiding this comment

Uh oh!

eerhardt Mar 3, 2026

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

Copilot AI commented Feb 13, 2026 •

edited

Loading

github-actions bot commented Feb 23, 2026 •

edited

Loading

github-actions bot commented Feb 23, 2026 •

edited

Loading