# Bicep Gate

> A pre-deployment gate for an Azure deployment template you have already
> written. Paste Bicep, an ARM template or `azure.yaml` and the page reads it in
> your browser, then reviews it across five lanes: deployment readiness,
> subscription capacity and quota, cost shape, SKU right-sizing, and the AKS
> Day-0 checklist.

Live at https://bicep-gate.skillsafe.ai/

## What it is for

The moment this app is built for is the one just before `azd up`, `az
deployment group create`, or the pipeline step that runs one of them. The user
already has the template. They are not asking anyone to design it. They want to
know what it will actually do to their subscription before it does it.

It is deliberately NOT an architecture designer. It never proposes a topology
from a prose description; it reads the file you wrote.

## The work object

One of, or several of, pasted together:

- a Bicep file (`.bicep`), including `param`, `var`, `resource`, `module`,
  `output` and `targetScope` declarations, loops, decorators and interpolation
- an ARM template (`deploymentTemplate.json`), including nested deployments
- an `azure.yaml` (the azd service manifest)

Several files at once are separated by a line reading `==== path/to/file.bicep ====`.
Files can also be dragged onto the page; they are read with `FileReader` and
never uploaded.

## The three-state answer, which is the point of the app

Every check returns one of **pass**, **fail** or **unknown**, and the third is
not a softer version of the second:

- **pass** — the pasted text shows the rule is satisfied.
- **fail** — the pasted text shows it is not, AND the scan could see the whole
  surface where the evidence would have appeared.
- **unknown** — the scan could NOT see the whole surface. Almost always this
  means the template has a `module x 'modules/foo.bicep'` reference whose body
  was not pasted, so anything that module might declare is invisible.

A tool that collapses those last two into "no" tells a user that something is
missing when it may simply be somewhere the tool could not look, and users act
on that. Every `unknown` here carries a `whyUnknown` string naming the surface
that was missing, and the page lists exactly which files it could not see.

There is one important refinement: a rule whose evidence lives entirely inside a
resource body that WAS pasted is not downgraded, because no module elsewhere can
reach in and change it. "This cluster sets no network policy" stays a fail;
"there is no autoscale setting anywhere" becomes unknown, because
`autoscalesettings` is a separate resource a module could declare.

## The five lanes

Every lane takes the same work object and returns the same seven-section
envelope. Only the fourth section differs.

| Lane | Section | What it answers | Source skill |
| --- | --- | --- | --- |
| `readiness` | DEPLOY ORDER | Will this deploy unattended? Parameters that prompt, secrets in outputs, azd service tags, scope, API versions, naming rules that fail at deploy rather than compile. | `@microsoft/azure-prepare` |
| `capacity` | QUOTA REQUESTS | Which allowance runs out first. Quota is per SKU family per region, so both are always named. | `@microsoft/azure-quotas` |
| `cost` | COST DRIVERS | The shape of the bill: what bills continuously, what multiplies, what accrues without a ceiling. | `@microsoft/azure-cost` |
| `rightsize` | SIZING TABLE | Families, burstable credit behaviour, orchestration mode, disk tier, zones, scaling rules. | `@microsoft/azure-compute` |
| `aks` | DAY-0 CHECKLIST | The AKS decisions that cannot be changed once the cluster exists. | `@microsoft/azure-kubernetes` |

Lane A's result hands off to lane B with a button, and every lane ships a free,
replayable worked example, so the whole app is reachable without spending a
credit.

## The free in-browser lane

Before any model is involved, the page parses the template locally and computes:
the resource inventory with types, API versions, regions and SKUs; the vCPU draw
grouped by SKU family and region; GPU families, which start at zero on a new
subscription; non-vCPU regional counts; every azd service-to-resource tag
mapping; and about forty pass/fail/unknown checks. None of that leaves the
browser, and it runs before sign-in.

Those facts are then passed into whichever lane the user runs, and the model's
answer is reconciled against them afterwards — the page shows where the reviewer
ignored something the scan flagged, and flags any place the reviewer stated an
`unknown` as a settled fact.

## Masking

An optional switch replaces subscription and tenant GUIDs, account keys, SAS
tokens and any words the user lists with stable placeholders. It applies to
**every field** of the run input — the template, the scan summary and the free
text box — and the app asserts that no listed value survives anywhere in the
payload before it will submit. If the assertion fails, the run button is
disabled rather than the request being sent with a warning.

## What it does not do

- **It never prices anything.** No price list ships in the bundle and the app
  cannot fetch one under its content security policy. The cost lane reports the
  shape of the bill and points at the Azure pricing calculator for figures.
- **It never contacts Azure.** It cannot read real quota, real usage, an
  agreement, or which SKUs are available in a region today. Quota figures are
  what the template draws, never what the subscription has.
- **It does not compile, deploy or run what-if.** A template that passes every
  check here can still fail `az deployment what-if`.
- **It is not a security review, a compliance audit or an approval.**

## Programmatic use

`https://api.skillsafe.ai/v1/app-api` — full tutorial with worked examples in
eight languages at https://bicep-gate.skillsafe.ai/api.html, token management at
https://bicep-gate.skillsafe.ai/tokens.html.

Every request carries `task` (one of the five lane ids), `template`,
`environment`, `context`, `masked` and `prescan`. Responses are Markdown with
exactly seven `##` sections. A section body of `None` is a complete answer, not
a missing one.

## Credits

Derived from and crediting five Microsoft Azure agent skills:
`@microsoft/azure-prepare`, `@microsoft/azure-quotas`, `@microsoft/azure-cost`,
`@microsoft/azure-compute` and `@microsoft/azure-kubernetes`. This is a derived
work and is not affiliated with or endorsed by Microsoft.

Built on the SkillSafe app platform. Runs are charged per run in SkillSafe
credits; the in-browser scan and the bundled examples are free.