1# Deploy Existing Copilot SDK App
2 
3Adapt a user's existing Copilot SDK app for Azure by scaffolding the template to a temp directory, then copying infra into the user's project.
4 
5> ⚠️ **Warning:** Do NOT run `azd init` inside the user's project — it overwrites existing files. Always scaffold to a temp dir.
6 
7## 1. Scaffold Template to Temp Dir
8 
9```bash
10azd init --template azure-samples/copilot-sdk-service --cwd <temp-dir>
11```
12 
13This gives you the working infra, scripts, and Dockerfiles without touching the user's project.
14 
15## 2. Copy Infra Into User's Project
16 
17From the temp scaffold, copy these into the user's project root:
18 
19| Source | Purpose |
20|--------|---------|
21| `infra/` | Bicep modules (AVM-based), main.bicep, resources.bicep |
22| `scripts/get-github-token.mjs` | azd hook — gets `GITHUB_TOKEN` via `gh auth token` |
23| `azure.yaml` | Deployment manifest (will need editing) |
24 
25> ⚠️ Copy `scripts/get-github-token.mjs` exactly — do NOT rewrite it.
26 
27## 3. Adapt azure.yaml
28 
29Edit the copied `azure.yaml` to point at the user's app:
30 
31- Set `services.api.project` to the user's API directory
32- Set `services.api.language` to the detected language
33- Set `services.api.ports` to the user's port
34- Add a `web` service if the app has a frontend
35- Keep the `hooks` section unchanged (preprovision + prerun call the token script)
36 
37## 4. GitHub Token Flow
38 
39The template's token flow (already in the copied files):
40 
411. **`scripts/get-github-token.mjs`** — runs `gh auth token`, verifies `copilot` scope, stores via `azd env set`
422. **`azure.yaml` hooks** — `preprovision` and `prerun` call the token script
433. **Bicep `@secure() param githubToken`** — azd auto-maps the env var
444. **Key Vault** — stores secret; Managed Identity gets `Key Vault Secrets User` role
45 
46## 5. Dockerfile
47 
48If the user has no Dockerfile, copy the template's Dockerfile for the detected language from the temp dir and adapt entry point, build steps, and port.
49 
50## 6. BYOM Infrastructure (Azure Model)
51 
52If the user wants Azure BYOM, add to the copied Bicep:
53 
54| Resource | Purpose |
55|----------|---------|
56| Azure OpenAI / AI Services account | Hosts model deployments |
57| Role assignment | `Cognitive Services OpenAI User` for Managed Identity |
58 
59Add env vars to Container App: `AZURE_OPENAI_ENDPOINT`, `MODEL_PROVIDER=azure`, `MODEL_NAME=<deployment>`, `AZURE_CLIENT_ID=<managed-identity-client-id>`.
60 
61> ⚠️ **Warning:** The template's `main.parameters.json` defaults to `gpt-4o` which does NOT support BYOM (encrypted content). Change the default to an o-series or gpt-5 family model.
62 
63See [Azure Model Configuration](azure-model-config.md) for provider config and auth pattern.
64 
65## 7. Errors
66 
67| Error | Fix |
68|-------|-----|
69| `gh` not installed | User must install GitHub CLI |
70| Missing `copilot` scope | Run `gh auth refresh --scopes copilot` |
71| Key Vault soft-delete conflict | Use a unique vault name or purge the old one |
72| Token not injected | Verify `azure.yaml` hooks and `scripts/get-github-token.mjs` exist |
73