[BREAKING] FEAT: Add fixed egress deployment for CoPyRIT

.github/workflows/bicep_topology.yml

@@ -0,0 +1,48 @@
+name: Bicep Topology
+
+on:
+  push:
+    branches:
+      - "main"
+    paths:
+      - 'infra/**/*.bicep'
+      - 'tests/unit/infra/**'
+      - '.github/workflows/bicep_topology.yml'
+  pull_request:
+    branches:
+      - "main"
+      - "release/**"
+    paths:
+      - 'infra/**/*.bicep'
+      - 'tests/unit/infra/**'
+      - '.github/workflows/bicep_topology.yml'
+  merge_group:
+  workflow_dispatch:
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.head_ref || github.run_id }}
+  cancel-in-progress: true
+
+jobs:
+  bicep-topology:
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+    env:
+      PYRIT_REQUIRE_BICEP: 'true'
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+
+      - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
+        with:
+          python-version: '3.11'
+
+      - name: Install Bicep CLI
+        env:
+          AZURE_CONFIG_DIR: ${{ runner.temp }}/.azure
+        run: az bicep install --version v0.46.1
+
+      - name: Compile and test Bicep topology
+        env:
+          AZURE_CONFIG_DIR: ${{ runner.temp }}/.azure
+        run: python tests/unit/infra/test_bicep_topology.py -v

docker/start.sh

@@ -37,10 +37,10 @@ fi
 echo "Checking PyRIT installation..."
 python -c "import pyrit; print(f'Running PyRIT version: {pyrit.__version__}')"
 
-# Write .env file from PYRIT_ENV_CONTENTS (injected as the Container App's
-# inline `env-file` secret; previously a Key Vault secretRef, but ACA isn't on
-# Key Vault's "trusted services" list so SFI-locked-down KVs can't be read at
-# runtime — see infra/main.bicep for details).
+# Write .env from the Container App's `env-file` secret. deploy_instance.py
+# supplies it inline. The optional Key Vault-backed Bicep path requires both
+# Key Vault Secrets User and an explicit vault network path because ACA is not
+# currently listed in Key Vault's trusted-services firewall bypass.
 if [ -n "$PYRIT_ENV_CONTENTS" ]; then
     mkdir -p ~/.pyrit
     echo "$PYRIT_ENV_CONTENTS" > ~/.pyrit/.env