feat: transfer Foundry provisioning to projects

[huimiu]

Related to #9134

Why

Foundry project provisioning still lived in azure.ai.agents, even though azure.ai.projects owns project resources. Moving provisioning now gives each extension a clearer job. We are keeping init in agents temporarily so the handoff can be validated before moving the remaining setup flow.

What changed

• Moved the microsoft.foundry provisioning provider from azure.ai.agents to azure.ai.projects.
• Moved split-project deployment handling to azure.ai.projects, while keeping the old agents path for backward compatibility.
• Kept azd ai agent init and init --infra in azure.ai.agents for now. Parity tests keep the temporary synthesis copies aligned.
• Added support for updating deployments and connections on existing Foundry projects. These projects must set AZURE_AI_PROJECT_ID to the full project ARM resource ID.
• Kept typed connection metadata while passing credentials separately as a secure ARM parameter.
• Used the customer VNet region when creating private endpoints.
• Blocked private-network projects from creating an ACR automatically, since the current templates do not create the ACR private networking they would need. Users should provide a pre-built image instead.
• Added projects unit tests to the agents CI workflow and installed the local projects dependency before running agents tests.

Follow-up work

• Move the remaining azd ai agent init and init --infra logic to azure.ai.projects and remove the temporary agents-side copy.
• Publish the coordinated projects and agents releases, then update the extension registry and microsoft.foundry meta-package together.

Release notes

The projects and agents releases must be published together. Mixing old and new versions can cause both extensions to register the same provider.

[azure-pipelines]

Azure Pipelines:
Successfully started running 2 pipeline(s).
20 pipeline(s) were filtered out due to trigger conditions.
There may be pipelines that require an authorized user to comment /azp run to run.

[azure-pipelines]

Azure Pipelines:
Successfully started running 2 pipeline(s).
20 pipeline(s) were filtered out due to trigger conditions.
There may be pipelines that require an authorized user to comment /azp run to run.

[github-actions]

📋 Prioritization Note

Thanks for the contribution! The linked issue isn't in the current milestone yet.
Thank you for logging this issue; our team is reviewing it. If you need urgent prioritization, tag @RickWinter and @kristenwomack to let us know.

[Copilot]

Pull request overview

Transfers Foundry provisioning ownership from azure.ai.agents to azure.ai.projects, including lifecycle projection, validation, infrastructure synthesis, and coordinated versioning.

Changes:

• Registers the Foundry provider and validation checks in Projects.
• Moves deployment projection while retaining legacy Agents fallback.
• Adds synchronized release metadata, tests, templates, and documentation.

Reviewed changes

Copilot reviewed 66 out of 67 changed files in this pull request and generated 9 comments.

Show a summary per file

File	Description
docs/reference/telemetry-data.md	Updates telemetry ownership.
cli/azd/extensions/azure.ai.projects/version.txt	Bumps Projects version.
cli/azd/extensions/azure.ai.projects/README.md	Documents project ownership.
cli/azd/extensions/azure.ai.projects/internal/version/version.go	Adds build metadata.
cli/azd/extensions/azure.ai.projects/internal/synthesis/templates/terraform/variables.tf	Defines Terraform inputs.
cli/azd/extensions/azure.ai.projects/internal/synthesis/templates/terraform/provider.tf	Configures Terraform providers.
cli/azd/extensions/azure.ai.projects/internal/synthesis/templates/terraform/outputs.tf.tmpl	Defines conditional outputs.
cli/azd/extensions/azure.ai.projects/internal/synthesis/templates/terraform/main.tf	Provisions core Foundry resources.
cli/azd/extensions/azure.ai.projects/internal/synthesis/templates/terraform/acr.tf	Provisions connected ACR.
cli/azd/extensions/azure.ai.projects/internal/synthesis/templates/modules/subnet.bicep	Adds subnet module.
cli/azd/extensions/azure.ai.projects/internal/synthesis/templates/modules/resources.bicep	Defines Foundry resources.
cli/azd/extensions/azure.ai.projects/internal/synthesis/templates/modules/private-endpoint-dns.bicep	Adds private endpoint and DNS.
cli/azd/extensions/azure.ai.projects/internal/synthesis/templates/modules/network.bicep	Adds VNet wiring.
cli/azd/extensions/azure.ai.projects/internal/synthesis/templates/modules/connections.bicep	Provisions project connections.
cli/azd/extensions/azure.ai.projects/internal/synthesis/templates/modules/acr.bicep	Adds Bicep ACR module.
cli/azd/extensions/azure.ai.projects/internal/synthesis/templates/main.bicep	Adds greenfield template.
cli/azd/extensions/azure.ai.projects/internal/synthesis/templates/brownfield.bicep	Adds existing-project template.
cli/azd/extensions/azure.ai.projects/internal/synthesis/templates/brownfield.arm.json	Embeds compiled brownfield ARM.
cli/azd/extensions/azure.ai.projects/internal/synthesis/templates/abbreviations.json	Defines resource abbreviations.
cli/azd/extensions/azure.ai.projects/internal/synthesis/templates_embed.go	Embeds provisioning templates.
cli/azd/extensions/azure.ai.projects/internal/synthesis/synthesizer.go	Adds configuration synthesis.
cli/azd/extensions/azure.ai.projects/internal/synthesis/schema_test.go	Tests schema and ARM parity.
cli/azd/extensions/azure.ai.projects/internal/synthesis/parity_test.go	Enforces Agents synthesis parity.
cli/azd/extensions/azure.ai.projects/internal/provisioning/resource_group_location_check.go	Moves location validation.
cli/azd/extensions/azure.ai.projects/internal/provisioning/resource_group_location_check_validate_test.go	Ports validation tests.
cli/azd/extensions/azure.ai.projects/internal/provisioning/resource_group_location_check_test.go	Ports location tests.
cli/azd/extensions/azure.ai.projects/internal/provisioning/provisioning_provider.go	Defines provider constants.
cli/azd/extensions/azure.ai.projects/internal/provisioning/preview_helpers.go	Moves preview helpers.
cli/azd/extensions/azure.ai.projects/internal/provisioning/preview_helpers_test.go	Ports preview tests.
cli/azd/extensions/azure.ai.projects/internal/provisioning/ondisk_template.go	Moves on-disk template support.
cli/azd/extensions/azure.ai.projects/internal/provisioning/ondisk_template_test.go	Ports template tests.
cli/azd/extensions/azure.ai.projects/internal/provisioning/foundry_provisioning_provider.go	Moves the Foundry provider.
cli/azd/extensions/azure.ai.projects/internal/provisioning/foundry_provisioning_provider_test.go	Ports provider tests.
cli/azd/extensions/azure.ai.projects/internal/provisioning/foundry_provisioning_provider_resolveenv_test.go	Tests environment resolution.
cli/azd/extensions/azure.ai.projects/internal/provisioning/foundry_provisioning_provider_destroy_confirm_test.go	Tests destroy confirmation.
cli/azd/extensions/azure.ai.projects/internal/provisioning/foundry_provisioning_provider_brownfield_acr_test.go	Tests brownfield ACR.
cli/azd/extensions/azure.ai.projects/internal/provisioning/contract_parity_test.go	Enforces migration contract parity.
cli/azd/extensions/azure.ai.projects/internal/exterrors/errors.go	Adds provider error helpers.
cli/azd/extensions/azure.ai.projects/internal/exterrors/codes.go	Adds provisioning error codes.
cli/azd/extensions/azure.ai.projects/internal/cmd/version.go	Uses shared version metadata.
cli/azd/extensions/azure.ai.projects/internal/cmd/service_target.go	Updates ownership documentation.
cli/azd/extensions/azure.ai.projects/internal/cmd/root.go	Registers providers and handlers.
cli/azd/extensions/azure.ai.projects/internal/cmd/project_service_config.go	Projects deployment environment data.
cli/azd/extensions/azure.ai.projects/internal/cmd/project_service_config_test.go	Tests lifecycle projection.
cli/azd/extensions/azure.ai.projects/internal/cmd/ownership_test.go	Tests extension ownership metadata.
cli/azd/extensions/azure.ai.projects/internal/azure/client_options.go	Configures Azure SDK clients.
cli/azd/extensions/azure.ai.projects/go.sum	Updates dependency checksums.
cli/azd/extensions/azure.ai.projects/go.mod	Adds provisioning dependencies.
cli/azd/extensions/azure.ai.projects/extension.yaml	Declares provider ownership.
cli/azd/extensions/azure.ai.projects/cspell.yaml	Adds spelling terms.
cli/azd/extensions/azure.ai.projects/ci-build.ps1	Updates CI linker metadata.
cli/azd/extensions/azure.ai.projects/CHANGELOG.md	Adds Projects release notes.
cli/azd/extensions/azure.ai.projects/build.sh	Updates Unix linker metadata.
cli/azd/extensions/azure.ai.projects/build.ps1	Updates Windows linker metadata.
cli/azd/extensions/azure.ai.projects/AGENTS.md	Documents ownership and release flow.
cli/azd/extensions/azure.ai.agents/version.txt	Bumps Agents version.
cli/azd/extensions/azure.ai.agents/README.md	Documents transferred ownership.
cli/azd/extensions/azure.ai.agents/internal/project/provisioning_provider.go	Updates provider ownership comment.
cli/azd/extensions/azure.ai.agents/internal/cmd/resource_services.go	Retains legacy deployment fallback.
cli/azd/extensions/azure.ai.agents/internal/cmd/resource_services_test.go	Tests split and legacy behavior.
cli/azd/extensions/azure.ai.agents/internal/cmd/listen.go	Removes provider registration.
cli/azd/extensions/azure.ai.agents/extension.yaml	Adds Projects dependency.
cli/azd/extensions/azure.ai.agents/docs/private-networking.md	Updates networking ownership docs.
cli/azd/extensions/azure.ai.agents/CHANGELOG.md	Adds Agents release notes.
cli/azd/extensions/azure.ai.agents/AGENTS.md	Documents coordinated release flow.

[jongio]

One test-coverage gap worth closing on the new synthesizer.

[Copilot]

Pull request overview

Copilot reviewed 67 out of 68 changed files in this pull request and generated 8 comments.

[Copilot]

Pull request overview

Copilot reviewed 79 out of 80 changed files in this pull request and generated 1 comment.

Comments suppressed due to low confidence (2)

cli/azd/extensions/azure.ai.projects/internal/provisioning/foundry_provisioning_provider.go:806

• AZURE_AI_PROJECT_ID and endpoint are combined without verifying that they identify the same project: the account and resource group come from the environment ID, while the project name comes from the endpoint. A stale or manually copied ID can therefore update model deployments—and potentially create an ACR or connections—in a different account while returning another project's endpoint. Parse the ID as an accounts/projects resource and reject it unless its account and project match the endpoint before what-if or deployment. (azd-code-reviewer)
  cli/azd/extensions/azure.ai.projects/internal/provisioning/foundry_provisioning_provider.go:157
• This path now resolves $ref before recognizing a brownfield endpoint, but ResourceGroupLocationCheck.isBrownfieldFoundryProject still reads endpoint directly from raw YAML. When the endpoint exists only in the referenced file, validation treats the project as greenfield and can block provisioning because of an unrelated resource-group location. Use the same ProjectEndpoint resolution with the project root in the validation check. (azd-code-reviewer)

[trangevi]

Reapproving after recent commit

[jongio]

One correctness concern on the Terraform provisioning path, otherwise the incremental change since my last look is just a docs wording tweak.

[huimiu]

@copilot resolve the merge conflicts in this pull request

[Copilot]

@copilot resolve the merge conflicts in this pull request

Resolved the merge conflicts and merged origin/main into this branch in c1f48e7. I kept Foundry provisioning ownership in azure.ai.projects and updated the transferred validation-check comment to use the current arm-provision terminology.

[jongio]

Caught up since my last pass. The origin/main merge in c1f48e7 and the telemetry doc reword are clean, no new issues there.

Still open from before: the Terraform for_each on azurerm_cognitive_deployment.model in azure.ai.projects/internal/synthesis/templates/terraform/main.tf. The comment says the deployments are created one at a time because ARM throttles concurrent deployments on a single account, but for_each does not serialize them. Terraform schedules the instances concurrently (up to -parallelism, default 10), so under real throttling this can intermittently hit 429s. Either the comment is inaccurate or the serialization is missing. If one-at-a-time is genuinely required, chain the deployments with explicit ordering rather than relying on the comment. Line-level detail is on the existing thread.

[jongio]

Re-reviewed the current HEAD after the merge of origin/main and the telemetry docs wording fix. The merge-conflict resolution keeps Foundry provisioning ownership in azure.ai.projects and aligns the transferred validation check with main's arm-provision terminology, which is consistent with the design. The merged main changes (the preflight to provision validation rename and the telemetry field renames) don't change this PR's behavior. No new issues in the incremental changes.

One mechanical heads up: the branch shows as conflicting again since main advanced past the merge commit, so it'll need another merge from main before it can go in.

[huimiu]

@copilot resolve the merge conflicts in this pull request

[Copilot]

@copilot resolve the merge conflicts in this pull request

Resolved the latest merge conflicts and merged origin/main into this branch in 2516ecc. I kept the projects extension’s direct Foundry provisioning dependencies and took the newer azd module version from main, then re-ran go test ./... -count=1 in cli/azd/extensions/azure.ai.projects.

[Copilot]

Pull request overview

Copilot reviewed 79 out of 80 changed files in this pull request and generated no new comments.

Comments suppressed due to low confidence (3)

cli/azd/extensions/azure.ai.projects/internal/provisioning/foundry_provisioning_provider.go:806

• [azd-code-reviewer] account is resolved from AZURE_AI_PROJECT_ID, but brownfieldParams derives projectName independently from the endpoint. A stale or mismatched ID can therefore upsert model deployments into the wrong account and connections into an unintended <ID account>/<endpoint project> pair. Validate that the ID is specifically a Cognitive Services project and that its account/project names match the endpoint before creating the deployment.
  cli/azd/extensions/azure.ai.projects/internal/provisioning/foundry_provisioning_provider.go:156
• [azd-code-reviewer] The provider now recognizes an endpoint supplied through $ref, but the provision validation check still detects brownfield projects with the raw, non-ref-aware foundryServiceEndpoint. Such a project can be blocked before initialization by an unrelated resource-group location mismatch even though brownfield provisioning creates no resource group. Reuse ProjectEndpoint (with the project root) in isBrownfieldFoundryProject as well.
  cli/azd/extensions/azure.ai.projects/internal/synthesis/templates/terraform/main.tf:90
• [azd-code-reviewer] for_each does not serialize Terraform resources; Terraform will schedule these model deployments concurrently, contrary to the comment and the Bicep path's @batchSize(1). That can hit the same account-level ARM throttling this code is intended to avoid. Model the deployments through a mechanism that enforces a sequential chain (for example, an ARM deployment with a serial copy) before supporting multiple entries here.

[jongio]

Re-approving after the latest sync. The only delta since my last approval on c1f48e7 is a merge from main that pulls in upstream doc, test, registry, and telemetry changes. None of this PR's own provisioning code (synthesizer, connections template, terraform module) changed in that merge, so my earlier review still holds.

[huimiu]

/check-enforcer override