Add Bicep validation workflow

.github/workflows/azure-dev-validation.yaml

@@ -0,0 +1,34 @@
+name: Validate AZD template
+on:
+  push:
+    branches: [ main ]
+  pull_request:
+    branches: [ main ]
+
+jobs:
+  build:
+
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v3
+
+      - name: Build Bicep for linting
+        uses: azure/CLI@v1
+        with:
+          inlineScript: az config set bicep.use_binary_from_path=false && az bicep build -f infra/main.bicep --stdout
+
+      - name: Run Microsoft Security DevOps Analysis
+        uses: microsoft/security-devops-action@preview
+        env:
+            GDN_TEMPLATEANALYZER_VERBOSE: 1
+            GDN_TEMPLATEANALYZER_ANALYZETEMPLATE: infra/main.bicep
+            GDN_TEMPLATEANALYZER_PARAMETERSFILEPATH: .github/workflows/test.parameters.json
+        id: msdo
+        with:
+          tools: templateanalyzer
+
+      - name: Upload alerts to Security tab
+        uses: github/codeql-action/upload-sarif@v2
+        with:
+          sarif_file: ${{ steps.msdo.outputs.sarifFile }}

.github/workflows/test.parameters.json

@@ -0,0 +1,57 @@
+{
+    "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentParameters.json#",
+    "contentVersion": "1.0.0.0",
+    "parameters": {
+      "environmentName": {
+        "value": "azd-openai"
+      },
+      "location": {
+        "value": "eastus"
+      },
+      "openAiResourceGroupLocation": {
+        "value": "eastus"
+      },
+      "principalId": {
+        "value": "${AZURE_PRINCIPAL_ID}"
+      },
+      "openAiServiceName": {
+        "value": "${AZURE_OPENAI_SERVICE}"
+      },
+      "openAiResourceGroupName": {
+        "value": "${AZURE_OPENAI_RESOURCE_GROUP}"
+      },
+      "openAiSkuName": {
+        "value": "S0"
+      },
+      "formRecognizerServiceName": {
+        "value": "${AZURE_FORMRECOGNIZER_SERVICE}"
+      },
+      "formRecognizerResourceGroupName": {
+        "value": "${AZURE_FORMRECOGNIZER_RESOURCE_GROUP}"
+      },
+      "formRecognizerSkuName": {
+        "value": "S0"
+      },
+      "searchServiceName": {
+        "value": "${AZURE_SEARCH_SERVICE}"
+      },
+      "searchServiceResourceGroupName": {
+        "value": "${AZURE_SEARCH_SERVICE_RESOURCE_GROUP}"
+      },
+      "searchServiceSkuName": {
+        "value": "standard"
+      },
+      "storageAccountName": {
+        "value": "${AZURE_STORAGE_ACCOUNT}"
+      },
+      "storageResourceGroupName": {
+        "value": "${AZURE_STORAGE_RESOURCE_GROUP}"
+      },
+      "chatGptDeploymentName": {
+        "value": "${AZURE_OPENAI_CHATGPT_DEPLOYMENT=chat}"
+      },
+      "gptDeploymentName": {
+        "value": "${AZURE_OPENAI_GPT_DEPLOYMENT=davinci}"
+      }
+    }
+  }

infra/core/host/appservice.bicep

@@ -49,6 +49,7 @@ resource appService 'Microsoft.Web/sites@2022-03-01' = {
       appCommandLine: appCommandLine
       numberOfWorkers: numberOfWorkers != -1 ? numberOfWorkers : null
       minimumElasticInstanceCount: minimumElasticInstanceCount != -1 ? minimumElasticInstanceCount : null
+      minTlsVersion: '1.2'
       use32BitWorkerProcess: use32BitWorkerProcess
       functionAppScaleLimit: functionAppScaleLimit != -1 ? functionAppScaleLimit : null
       healthCheckPath: healthCheckPath