Refactor Azure Functions integration and enhance project structure #45

spboyer · 2025-04-07T22:54:11Z

Refactor the integration of Azure Functions and improve the project structure. Update the Dockerfile for Python 3.10, enhance the development environment, and expand the README with installation and security practices. Implement logging in function handlers, add new API routes, and update Bicep templates for better resource management. Introduce a security scan workflow and add a Code of Conduct and Security Policy. Update dependencies for better management.

- Updated Dockerfile to use Python 3.10 and install Azure Functions Core Tools. - Modified devcontainer.json for improved development environment setup. - Expanded .funcignore to exclude additional files and directories. - Enhanced README.md with detailed features, installation instructions, and security practices. - Implemented logging in function handlers and added new API routes. - Updated Bicep templates for better resource management and diagnostics. - Added security scan workflow for automated vulnerability checks. - Introduced Code of Conduct and Security Policy documents. - Updated requirements.txt with specific package versions for better dependency management.

github-advanced-security · 2025-04-07T22:55:30Z

This pull request sets up GitHub code scanning for this repository. Once the scans have completed and the checks have passed, the analysis results for this pull request branch will appear on this overview. Once you merge this pull request, the 'Security' tab will show more code scanning analysis results (for example, for the default branch). Depending on your configuration and choice of analysis tool, future pull requests will be annotated with code scanning analysis results. For more information about GitHub code scanning, check out the documentation.

github-advanced-security · 2025-04-07T22:55:30Z

This pull request sets up GitHub code scanning for this repository. Once the scans have completed and the checks have passed, the analysis results for this pull request branch will appear on this overview. Once you merge this pull request, the 'Security' tab will show more code scanning analysis results (for example, for the default branch). Depending on your configuration and choice of analysis tool, future pull requests will be annotated with code scanning analysis results. For more information about GitHub code scanning, check out the documentation.

github-advanced-security · 2025-04-07T22:55:30Z

This pull request sets up GitHub code scanning for this repository. Once the scans have completed and the checks have passed, the analysis results for this pull request branch will appear on this overview. Once you merge this pull request, the 'Security' tab will show more code scanning analysis results (for example, for the default branch). Depending on your configuration and choice of analysis tool, future pull requests will be annotated with code scanning analysis results. For more information about GitHub code scanning, check out the documentation.

github-advanced-security · 2025-04-07T22:55:30Z

This pull request sets up GitHub code scanning for this repository. Once the scans have completed and the checks have passed, the analysis results for this pull request branch will appear on this overview. Once you merge this pull request, the 'Security' tab will show more code scanning analysis results (for example, for the default branch). Depending on your configuration and choice of analysis tool, future pull requests will be annotated with code scanning analysis results. For more information about GitHub code scanning, check out the documentation.

github-advanced-security · 2025-04-07T22:55:30Z

This pull request sets up GitHub code scanning for this repository. Once the scans have completed and the checks have passed, the analysis results for this pull request branch will appear on this overview. Once you merge this pull request, the 'Security' tab will show more code scanning analysis results (for example, for the default branch). Depending on your configuration and choice of analysis tool, future pull requests will be annotated with code scanning analysis results. For more information about GitHub code scanning, check out the documentation.

.github/workflows/security-scan.yml

+    permissions:
+      actions: read


paulyuk · 2025-07-14T20:06:22Z

I like what this PR is aiming to do, but I'd ask we collab on a few implementation details:

this should use the Azure Functions Python v2 programming model, which would mean no function.json, having the right decorators, etc.
we have a supported extension now for http streaming and fast API, as documented here. This can eliminate the whole wrapper and custom streams approach attempted currently in the sample and PR.
this uses Consumption v1 Linux (Y1) plan which is headed towards deprecation. We should use Flex Consumption plan, MI, and optional VNET like in our other samples. Consider using 100% of the ./infra folder in this Python function http quickstart to obtain updated secure bicep for Flex.
the dockerfile should be optional so this starts as a native Function. But if dockerfile is requirement, then I suppose this would turn into an ACA sample. I just dont want to make that fork in the road too complex.
the codespaces folder should xcopy this updated improved one that works with Functions: https://github.com/Azure-Samples/functions-quickstart-python-http-azd/tree/main/.devcontainer
the readme should be updated so azure-samples metadata is not visible. you can do this by surrounding the metadata in a comment, like this: https://github.com/Azure-Samples/functions-quickstart-python-http-azd/blob/main/README.md?plain=1#L1C1-L16C4.

@spboyer and @pamelafox could we collab and merge a rev of this with the points above handled?

pamelafox · 2025-07-14T20:13:10Z

.devcontainer/devcontainer.json

@@ -1,5 +1,5 @@
 {
-    "name": "FastAPI on Azure Functions",
+    "name": "Python FastAPI Function",


I think the original title was more specific/cleaer

pamelafox · 2025-07-14T20:14:07Z

.devcontainer/devcontainer.json

            ]
        }
    },
-    "postCreateCommand": "python3 -m venv .venv",
+    "postCreateCommand": "pip install -r requirements.txt",
    "postAttachCommand": ". .venv/bin/activate",


It seems weird that postAttachCommand activates venv, but postCreate no longer makes it? I think that's wrong. postCreate should still make it?

pamelafox · 2025-07-14T20:15:17Z

README.md

+### Prerequisites
+- Python 3.9 or later
+- Azure Functions Core Tools
+- Azure CLI


Azure CLI? Shouldnt it be azd? Or does it need both?

it should be azd only

pamelafox · 2025-07-14T20:16:40Z

startup.py

@@ -0,0 +1,7 @@
+from fastapi import FastAPI
+
+app = FastAPI()


Is this file used?

paulyuk · 2025-07-14T20:39:31Z

@copilot please address my comments and Pamelafox's

Copilot

Pull Request Overview

Refactors Azure Functions integration with FastAPI, enhances infrastructure templates, updates the development container, and expands project documentation and security practices.

Reworked function_app entrypoint using FunctionApp and ASGI middleware, removed previous wrapper approach
Parameterized and improved Bicep templates (resource group logic, tags, role assignment, outputs)
Updated devcontainer Dockerfile to Python 3.10, added security scan workflow, and expanded README/SECURITY docs

Reviewed Changes

Copilot reviewed 22 out of 24 changed files in this pull request and generated 3 comments.

Show a summary per file

File	Description
startup.py	Added simple FastAPI test route
infra/main.bicep	Parameterized resource group, tags, module renames, outputs
infra/core/storage/storage-account.bicep	Added new storage account parameters and updated resource blocks
infra/core/host/functions.bicep	Enabled managed identity, skip role assignment logic, added roleAssignment
infra/core/host/appservice.bicep	Unified tags with `azd-service-name`
host.json	Expanded logging config, bumped extensionBundle version, set timeout
function_app.py	Defined FastAPI routes, created `FunctionApp`, applied ASGI middleware
SECURITY.md	Added security policy template
README.md	Expanded installation instructions, features, and security notice
.devcontainer/Dockerfile	Switched base image to Python 3.10, venv creation, updated tools
.github/workflows/security-scan.yml	Introduced weekly security scan workflow

Comments suppressed due to low confidence (3)

SECURITY.md:8

Replace the placeholder '[SECURITY CONTACT EMAIL]' with an actual security contact email address.

2. Send details of the vulnerability to [SECURITY CONTACT EMAIL].

README.md:91

[nitpick] There's a second '## Prerequisites' section here. Consider consolidating duplicate sections to improve the README's clarity.

## Prerequisites

infra/main.bicep:18

Using uniqueString(name) reduces the uniqueness domain compared to the original uniqueString(subscription().id, name, location), which may cause name collisions across subscriptions or regions. Consider reverting to the original inputs for collision safety.

var prefix = '${name}-${uniqueString(name)}'

Copilot · 2025-07-14T20:42:04Z

infra/main.bicep

@@ -2,86 +2,111 @@ targetScope = 'subscription'

 @minLength(1)
 @maxLength(64)
-@description('Name which is used to generate a short unique hash for each resource')
+@description('Name of the the environment which is used to generate a short unique hash used in all resources.')


Duplicate word 'the the' in the description. It should read 'Name of the environment which is used to generate a short unique hash used in all resources.'

Suggested change

@description('Name of the the environment which is used to generate a short unique hash used in all resources.')

@description('Name of the environment which is used to generate a short unique hash used in all resources.')

Copilot · 2025-07-14T20:42:04Z

infra/core/host/functions.bicep

@@ -7,7 +7,7 @@ param tags object = {}
 param applicationInsightsName string = ''
 param appServicePlanId string
 param keyVaultName string = ''
-param managedIdentity bool = !empty(keyVaultName)
+param managedIdentity bool = true // Always enable managed identity


[nitpick] The managedIdentity parameter is now always true and no longer drives any conditional logic. It can be removed to simplify this template.

Suggested change

param managedIdentity bool = true // Always enable managed identity

Copilot · 2025-07-14T20:42:04Z

startup.py

+from fastapi import FastAPI
+
+app = FastAPI()
+
+@app.get("/api/test")
+async def test():
+    return {"message": "FastAPI on Azure Functions"}


[nitpick] startup.py defines a FastAPI app that isn't referenced by the current function.json bindings. Consider removing or consolidating it with function_app.py to avoid dead code.

Suggested change

from fastapi import FastAPI

app = FastAPI()

@app.get("/api/test")

async def test():

return {"message": "FastAPI on Azure Functions"}

# Removed unused FastAPI app and route definition as it is not referenced elsewhere.

paulyuk

Please see comments and resolve.

paulyuk · 2025-07-14T20:42:22Z

.azuredeployrc.json

I'm not sure this should be included.

paulyuk · 2025-07-14T20:43:34Z

HttpTrigger/__init__.py

This should not be needed in pythonv2 model.

paulyuk · 2025-07-14T20:43:53Z

HttpTrigger/function.json

Do not include this. We should use Pythonv2 programming model

paulyuk · 2025-07-14T20:44:28Z

README.md

+
+## Costs
+The main cost components for this solution are:
+- Azure Functions consumption plan (pay-per-execution)


Suggested change

- Azure Functions consumption plan (pay-per-execution)

- Azure Functions Flex Consumption plan (pay-per-execution)

paulyuk · 2025-07-14T20:45:32Z

WrapperFunction/__init__.py

We will not need this file anymore once we use the supported http streams and fastapi extension for azure functions. https://learn.microsoft.com/en-us/azure/azure-functions/functions-bindings-http-webhook-trigger?tabs=python-v2%2Cisolated-process%2Cnodejs-v4%2Cfunctionsv2&pivots=programming-language-python#example

paulyuk · 2025-07-14T20:46:02Z

WrapperFunction/function.json

File not needed in Python v2

paulyuk · 2025-07-14T20:48:10Z

function.json

File not needed in Python v2

paulyuk · 2025-07-14T20:48:29Z

function_app.py

 import azure.functions as func
+from fastapi import FastAPI


We need to add extension per doc

paulyuk · 2025-07-14T20:49:32Z

infra/main.bicep

Really all of this bicep should be replaced by the newer AVM based version here:
https://github.com/Azure-Samples/functions-quickstart-python-http-azd/tree/main/infra

spboyer added 2 commits April 7, 2025 18:30

Add HTTP extensions configuration to host.json, main route back to root

04fbe03

github-advanced-security bot found potential problems Apr 7, 2025

View reviewed changes

.github/workflows/security-scan.yml

Comment on lines +14 to +15

permissions:

actions: read

Check failure

Code scanning / checkov

Ensure top-level permissions are not set to write-all Error

Ensure top-level permissions are not set to write-all

Update CodeQL SARIF upload action to v3

5e07590

pamelafox reviewed Jul 14, 2025

View reviewed changes

paulyuk assigned paulyuk and spboyer Jul 14, 2025

pamelafox reviewed Jul 14, 2025

View reviewed changes

startup.py

@@ -0,0 +1,7 @@

from fastapi import FastAPI

app = FastAPI()

Copy link

Contributor

pamelafox Jul 14, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Is this file used?

paulyuk requested a review from Copilot July 14, 2025 20:40

Copilot AI reviewed Jul 14, 2025

View reviewed changes

paulyuk requested changes Jul 14, 2025

View reviewed changes

paulyuk unassigned paulyuk and spboyer Jul 14, 2025

paulyuk mentioned this pull request Jul 14, 2025

Template refresh with AZD, security, and Python functions best practices #51

Open

Copilot AI mentioned this pull request Jul 14, 2025

Modernize FastAPI template with Azure Functions Python v2, Flex Consumption, and enhanced security #52

Open

	@description('Name of the the environment which is used to generate a short unique hash used in all resources.')
	@description('Name of the environment which is used to generate a short unique hash used in all resources.')

	- Azure Functions consumption plan (pay-per-execution)
	- Azure Functions Flex Consumption plan (pay-per-execution)

Refactor Azure Functions integration and enhance project structure #45

Are you sure you want to change the base?

Refactor Azure Functions integration and enhance project structure #45

Uh oh!

Conversation

spboyer commented Apr 7, 2025

Uh oh!

github-advanced-security bot commented Apr 7, 2025

Uh oh!

github-advanced-security bot commented Apr 7, 2025

Uh oh!

github-advanced-security bot commented Apr 7, 2025

Uh oh!

github-advanced-security bot commented Apr 7, 2025

Uh oh!

github-advanced-security bot commented Apr 7, 2025

Uh oh!

Check failure

paulyuk commented Jul 14, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

paulyuk commented Jul 14, 2025

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull Request Overview

Reviewed Changes

Uh oh!

Copilot AI Jul 14, 2025

Choose a reason for hiding this comment

Uh oh!

Copilot AI Jul 14, 2025

Choose a reason for hiding this comment

Uh oh!

Copilot AI Jul 14, 2025

Choose a reason for hiding this comment

Uh oh!

paulyuk left a comment

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

paulyuk commented Jul 14, 2025 •

edited

Loading