Reference for the eagle-demi-admin workflows: PR checks and the test and production deploys. The workflow index and repository settings are CI-Workflows.

Runs on every pull request against main in digitalspace/eagle-demi-admin. One job, contents: read only: corepack enable, yarn install --immutable, yarn lint, yarn test, then yarn build with VITE_BUILD_ID=pr (a PR build is never published, so the build id is a placeholder rather than a sha). Node 24.

digitalspace/eagle-demi-admin's equivalent of the DEMI frontend deploy: pushes the Vite bundle to $web on the demi-admin-cicd-test-managed storage account in c4b0a8-test-rg, behind the same eagle-edge Front Door pattern. Triggers on push to main under src/**, public/**, index.html, package.json, yarn.lock, vite.config.*, tsconfig*.json and scripts/deploy-azure.sh, or workflow_dispatch.

1. Rewrite public/env.js before the build, via scripts/point-env-js.sh test — the same script the production workflow calls, not inline sed. It matches each line by key name rather than by its committed value, sets Keycloak host to test.loginproxy.gov.bc.ca, ENVIRONMENT to 'test', APPINSIGHTS_CONNECTION_STRING from secrets.APPINSIGHTS_CONNECTION_STRING_TEST (an environment secret on the test GitHub environment, not a repository variable), ANALYTICS_API_URL from the repository variable of the same name, and configEndpoint (forced true). Each rewrite is followed by a grep that fails the job if it did not take — the script errors first if APPINSIGHTS_CONNECTION_STRING is empty, before even calling point-env-js.sh.
2. yarn test before yarn build — a broken classifier stops the deploy instead of shipping and being found later on the Uptime screen.
3. VITE_BUILD_ID set to the first 8 characters of GITHUB_SHA, read at build time by Vite.
4. ./scripts/deploy-azure.sh (no target argument — this repo publishes only one bundle).
5. A Front Door smoke test (GET / expects 200) that no-ops with a notice if AZURE_FRONTDOOR_ENDPOINT is not yet set as a repository variable.

Identity: UAMI demi-admin-cicd-test, federated subject repo:digitalspace/eagle-demi-admin:environment:test. Holds Storage Blob Data Contributor and Storage Account Contributor on that one storage account, nothing wider.

workflow_dispatch only, taking a tag input shaped vX.Y.Z. The job checks out refs/tags/<tag> before anything else runs, so a branch of the same name cannot slip in, and stamps the tag itself into VITE_BUILD_ID — the build carries the release it came from, not a sha.

1. Rewrite public/env.js at the checked-out tag with scripts/point-env-js.sh prod — the same script the test workflow calls. Sets Keycloak host to loginproxy.gov.bc.ca, ENVIRONMENT to 'prod', APPINSIGHTS_CONNECTION_STRING from secrets.APPINSIGHTS_CONNECTION_STRING_PROD, ANALYTICS_API_URL from the repository variable, and configEndpoint (forced true). There is no notify-api-prod yet, so NOTIFY_API_LOCATION stays unset and the eagle-notify screen in production reads "Not configured".
2. yarn test before yarn build, same reasoning as test.
3. ./scripts/deploy-azure.sh, then the same Front Door smoke test as the test workflow.

Identity: UAMI demi-admin-cicd-prod in rg-demi-prod (subscription c4b0a8-prod), federated subject repo:digitalspace/eagle-demi-admin:environment:prod. Holds Storage Blob Data Contributor and Storage Account Contributor on the production storage account, granted by azure/main.prod.bicepparam via uploaderPrincipalId — the two role assignments are skipped while that value is empty, and the first publish then fails with 403.

Secrets on the prod GitHub environment: AZURE_CLIENT_ID, AZURE_TENANT_ID, APPINSIGHTS_CONNECTION_STRING_PROD. Variables: AZURE_SUBSCRIPTION_ID, AZURE_FRONTEND_STORAGE_ACCOUNT (demiadmproduvtikwlcqtpga), AZURE_FRONTDOOR_ENDPOINT (demi-admin-prod-hfgebphjbucqd5bt.a01.azurefd.net), ANALYTICS_API_URL. The AZURE_FRONTDOOR_ENDPOINT host comes from the sites[] entry this app gets added as in digitalspace/eagle-edge (PR #27, param demiAdminFrontendWebHostName plus demiApimDeployed = true, routes default and api).

The production estate is live: storage account demiadmproduvtikwlcqtpga in rg-demi-prod (subscription be5924ac-1083-4a1b-be92-7b444882cfd9), Front Door endpoint above on profile eagle-edge-prod. demi-api-fc-prod's CORS_ORIGIN holds that Front Door host (eagle-demi PR #344, frontendHostNames), and Keycloak prod client eagle-admin-console has a redirect URI for it, added with scripts/keycloak-add-redirect.sh (ENV=prod). First live tag v1.0.1. deploy-infra.sh prod needs APIM_SHARED_HEADER_VALUE and AUDIT_SHARED_HEADER_VALUE exported by hand before a rerun; both are readable from app settings on analytics-api-fc-prod (rg-eagle-public-prod).