fix: Replace Bicep DeploymentScripts with post-deployment setup scripts (#2153)

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: Roopan-Microsoft <168007406+Roopan-Microsoft@users.noreply.github.com>
Co-authored-by: Ajit Padhi <v-padhiajit@microsoft.com>
Co-authored-by: Pavan-Microsoft <v-kupavan@microsoft.com>
Co-authored-by: Ross Smith <ross-p-smith@users.noreply.github.com>
Co-authored-by: gpickett <122489228+gpickett@users.noreply.github.com>
Co-authored-by: Francia Riesco <friesco@microsoft.com>
Co-authored-by: Francia Riesco <Fr4nc3@users.noreply.github.com>
Co-authored-by: Prajwal D C <v-dcprajwal@microsoft.com>
Co-authored-by: Harmanpreet-Microsoft <v-harmanprka@microsoft.com>
Co-authored-by: UtkarshMishra-Microsoft <v-utkamishra@microsoft.com>
Co-authored-by: Priyanka-Microsoft <v-prisinghal@microsoft.com>
Co-authored-by: Prasanjeet-Microsoft <v-singhprasa@microsoft.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Kiran-Siluveru-Microsoft <v-ksiluveru@microsoft.com>
Co-authored-by: Prashant-Microsoft <v-pmalusare@microsoft.com>
Co-authored-by: Rohini-Microsoft <v-rwalunj@microsoft.com>
Co-authored-by: Avijit-Microsoft <v-aghorui@microsoft.com>
Co-authored-by: RaviKiran-Microsoft <v-ravikirans@microsoft.com>
Co-authored-by: Somesh Joshi <v-somejoshi@microsoft.com>
Co-authored-by: Himanshi Agrawal <v-himagrawal@microsoft.com>
Co-authored-by: pradeepjha-microsoft <v-pradeepjha@microsoft.com>
Co-authored-by: Harmanpreet Kaur <v-harmanpkau@microsoft.com>
Co-authored-by: Bangarraju-Microsoft <v-golib@microsoft.com>
Co-authored-by: Harsh-Microsoft <v-hbangera@microsoft.com>
Co-authored-by: Kanchan-Microsoft <v-knagshetti@microsoft.com>
Co-authored-by: Cristopher Coronado <cristofima@hotmail.com>
Co-authored-by: Cristopher Coronado Moreira <crcorona@pichincha.com>
Co-authored-by: Vamshi-Microsoft <v-vamolla@microsoft.com>
Co-authored-by: Thanusree-Microsoft <168087422+Thanusree-Microsoft@users.noreply.github.com>
Co-authored-by: Niraj Chaudhari (Persistent Systems Inc) <v-nirajcha@microsoft.com>
Co-authored-by: Rohini-Microsoft <168007985+Rohini-Microsoft@users.noreply.github.com>
Co-authored-by: Kingshuk-Microsoft <v-kidatta@microsoft.com>
Co-authored-by: Ayaz-Microsoft <v-ayazkhan@microsoft.com>
Co-authored-by: Prekshith-Microsoft <v-pdj@microsoft.com>
Co-authored-by: Rafi-Microsoft <v-rafmd@microsoft.com>
Co-authored-by: Ragini-Microsoft <v-raginich@microsoft.com>
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
Co-authored-by: Atulku-Microsoft <v-atulku@microsoft.com>
Co-authored-by: Akhileswara-Microsoft <v-golnaidu@microsoft.com>
Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com>
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Author: 40 people

README.md

@@ -199,7 +199,18 @@ Select either "PostgreSQL" or "Cosmos DB":
 ![Solution Architecture - DB Selection](/docs/images/db_selection.png)
 
 
-When Deployment is complete, follow steps in [Set Up Authentication in Azure App Service](./docs/azure_app_service_auth_setup.md) to add app authentication to your web app running on Azure App Service
+**When Deployment is complete:**
+
+1. Run the post-deployment setup script to configure the Function App client key and create PostgreSQL tables (if applicable). Open [Azure Cloud Shell](https://shell.azure.com) (Bash) and run:
+
+    ```bash
+    az login
+    git clone https://github.com/Azure-Samples/chat-with-your-data-solution-accelerator.git
+    cd chat-with-your-data-solution-accelerator
+    bash scripts/post_deployment_setup.sh "<your-resource-group-name>"
+    ```
+
+2. Follow steps in [Set Up Authentication in Azure App Service](./docs/azure_app_service_auth_setup.md) to add app authentication to your web app running on Azure App Service
 
 **Note**: The default configuration deploys an OpenAI Model "gpt-4.1" with version 2025-04-14. However, not all
 locations support this version. If you're deploying to a location that doesn't support version 2024-05-13, you'll need to
@@ -264,7 +275,7 @@ Check out similar solution accelerators
 | [AI&nbsp;playbook](https://learn.microsoft.com/en-us/ai/playbook/) | The Artificial Intelligence (AI) Playbook provides enterprise software engineers with solutions, capabilities, and code developed to solve real-world AI problems. |
 | [Data&nbsp;playbook](https://learn.microsoft.com/en-us/data-engineering/playbook/understanding-data-playbook) | The data playbook provides enterprise software engineers with solutions which contain code developed to solve real-world problems. Everything in the playbook is developed with, and validated by, some of Microsoft's largest and most influential customers and partners. |
 
-<br/> 
+<br/>
 
 ### Resource links
 

docs/LOCAL_DEPLOYMENT.md

@@ -251,8 +251,8 @@ azd auth login --tenant-id <tenant-id>
 
 ### 4.2 Start Deployment
 
-**NOTE:** If you are running the latest azd version (version 1.23.9), please run the following command. 
-```bash 
+**NOTE:** If you are running the latest azd version (version 1.23.9), please run the following command.
+```bash
 azd config set provision.preflight off
 ```
 
@@ -289,20 +289,36 @@ After successful deployment, locate your application URLs:
 
 ## Step 5: Post-Deployment Configuration
 
-### 5.1 Configure Authentication (Required for Chat Application)
+### 5.1 Run Post-Deployment Setup Script (Required)
+
+After deployment completes, run the post-deployment script to configure the Function App client key and create PostgreSQL tables (if applicable):
+
+**PowerShell (Windows):**
+```powershell
+./scripts/post_deployment_setup.ps1 -ResourceGroupName "<your-resource-group-name>"
+```
+
+**Bash (Linux/macOS/WSL):**
+```bash
+bash scripts/post_deployment_setup.sh "<your-resource-group-name>"
+```
+
+> **Note:** The script auto-discovers all resources in the resource group. It handles private networking (WAF) deployments by temporarily enabling public access, performing the setup, then restoring the original state.
+
+### 5.2 Configure Authentication (Required for Chat Application)
 
 **This step is mandatory for Chat Application access:**
 
 1. Follow [App Authentication Configuration](./azure_app_service_auth_setup.md)
 2. Wait up to 10 minutes for authentication changes to take effect
 
-### 5.2 Verify Deployment
+### 5.3 Verify Deployment
 
 1. Access your application using the URL from Step 4.3
 2. Confirm the application loads successfully
 3. Verify you can sign in with your authenticated account
 
-### 5.3 Test the Application
+### 5.4 Test the Application
 
 **Quick Test Steps:**
 1. Navigate to the admin site, where you can upload documents. Then select Ingest Data and add your data. You can find sample data in the [data](../data) directory.

docs/NON_DEVCONTAINER_SETUP.md

@@ -53,7 +53,21 @@ The Azure Developer CLI (`azd`) is a developer-centric command-line interface (C
     ```
     > **Note:** This solution accelerator requires **Azure Developer CLI (azd) version 1.18.0 or higher**. Please ensure you have the latest version installed before proceeding with deployment. [Download azd here](https://learn.microsoft.com/en-us/azure/developer/azure-developer-cli/install-azd).
 
-    > Select your desired `subscription` and `location`. Wait a moment for the resource deployment to complete, click the website endpoint and you will see the web app page.
+    > Select your desired `subscription` and `location`. Wait a moment for the resource deployment to complete.
+
+1. Run the post-deployment setup script:
+
+    **PowerShell (Windows):**
+    ```powershell
+    ./scripts/post_deployment_setup.ps1 -ResourceGroupName "<your-resource-group-name>"
+    ```
+
+    **Bash (Linux/macOS/WSL):**
+    ```bash
+    bash scripts/post_deployment_setup.sh "<your-resource-group-name>"
+    ```
+
+1. Click the website endpoint and you will see the web app page.
 
 ## 🛠️ Troubleshooting
 If you encounter any issues during the deployment process, please refer to the [TroubleShootingSteps](TroubleShootingSteps.md) document for detailed steps and solutions.

infra/main.bicep

@@ -339,7 +339,6 @@ var blobContainerName = 'documents'
 var queueName = 'doc-processing'
 var clientKey = '${uniqueString(guid(subscription().id, deployment().name))}${newGuidString}'
 var eventGridSystemTopicName = 'evgt-${solutionSuffix}'
-var baseUrl = 'https://raw.githubusercontent.com/Azure-Samples/chat-with-your-data-solution-accelerator/main/'
 
 @description('Optional. Image version tag to use.')
 param appversion string = 'latest_waf' // Update GIT deployment branch
@@ -841,25 +840,6 @@ module postgresDBModule 'br/public:avm/res/db-for-postgre-sql/flexible-server:0.
   }
 }
 
-module pgSqlDelayScript 'br/public:avm/res/resources/deployment-script:0.5.1' = if (databaseType == 'PostgreSQL') {
-  name: take('avm.res.deployment-script.delay.${postgresResourceName}', 64)
-  params: {
-    name: 'delay-for-postgres-${solutionSuffix}'
-    location: resourceGroup().location
-    tags: tags
-    kind: 'AzurePowerShell'
-    enableTelemetry: enableTelemetry
-    scriptContent: 'start-sleep -Seconds 600'
-    azPowerShellVersion: '11.0'
-    timeout: 'PT15M'
-    cleanupPreference: 'Always'
-    retentionInterval: 'PT1H'
-  }
-  dependsOn: [
-    postgresDBModule
-  ]
-}
-
 // Store secrets in a keyvault
 var keyVaultName = 'kv-${solutionSuffix}'
 module keyvault './modules/key-vault/vault/vault.bicep' = {
@@ -1446,7 +1426,6 @@ module function 'modules/app/function.bicep' = {
     serverFarmResourceId: webServerFarm.outputs.resourceId
     applicationInsightsName: enableMonitoring ? monitoring!.outputs.applicationInsightsName : ''
     storageAccountName: storage.outputs.name
-    clientKey: clientKey
     userAssignedIdentityResourceId: managedIdentityModule.outputs.resourceId
     userAssignedIdentityClientId: managedIdentityModule.outputs.clientId
     // WAF aligned configurations
@@ -1852,37 +1831,6 @@ module systemAssignedIdentityRoleAssignments './modules/app/roleassignments.bice
   }
 }
 
-//========== Deployment script to upload data ========== //
-module createIndex 'br/public:avm/res/resources/deployment-script:0.5.1' = if (databaseType == 'PostgreSQL') {
-  name: take('avm.res.resources.deployment-script.createIndex', 64)
-  params: {
-    kind: 'AzureCLI'
-    name: 'copy_demo_Data_${solutionSuffix}'
-    azCliVersion: '2.52.0'
-    cleanupPreference: 'Always'
-    location: location
-    enableTelemetry: enableTelemetry
-    managedIdentities: {
-      userAssignedResourceIds: [
-        managedIdentityModule.outputs.resourceId
-      ]
-    }
-    retentionInterval: 'PT1H'
-    runOnce: true
-    primaryScriptUri: '${baseUrl}scripts/run_create_table_script.sh'
-    arguments: '${baseUrl} ${resourceGroup().name} ${postgresDBModule!.outputs.fqdn} ${managedIdentityModule.outputs.name}'
-    storageAccountResourceId: storage.outputs.resourceId
-    subnetResourceIds: enablePrivateNetworking
-      ? [
-          virtualNetwork!.outputs.deploymentScriptsSubnetResourceId
-        ]
-      : null
-    tags: tags
-    timeout: 'PT30M'
-  }
-  dependsOn: [pgSqlDelayScript]
-}
-
 var azureOpenAIModelInfo = string({
   model: azureOpenAIModel
   model_name: azureOpenAIModelName