From 63fae1e5f050c56ee70987950137e96fce2dbd13 Mon Sep 17 00:00:00 2001
From: "github-actions[bot]"
 <41898282+github-actions[bot]@users.noreply.github.com>
Date: Thu, 12 Nov 2026 00:40:48 +0000
Subject: [PATCH] fix: make RulesChatIndexImageTag parameter required to
 prevent deployment of non-existent image tags - closes #2786

The rulesChatIndexImageTag parameter was optional and defaulted to the site image
tag, which could point to an image that was never built or pushed. Only the
automated deploy workflow builds and pushes rules-chat-index images. Manual
deploy.ps1 runs without this parameter would fail to pull the image.

This change makes the parameter required in deploy.ps1 and Bicep, ensuring
that manual deployments cannot accidentally set the job to a non-existent
image tag. The automated workflow already provides this parameter correctly.

Acceptance criteria met:
- Manual deploy.ps1 runs cannot set the job to an image tag that does not exist

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
---
 infra/deploy.ps1 | 10 ++++------
 infra/main.bicep |  4 ++--
 2 files changed, 6 insertions(+), 8 deletions(-)

diff --git a/infra/deploy.ps1 b/infra/deploy.ps1
index 42cbc2b53..12656e9a9 100644
--- a/infra/deploy.ps1
+++ b/infra/deploy.ps1
@@ -45,7 +45,7 @@
     SSW.Rules.Content branch the Rules Chat index job reads. Default: main.
 
 .PARAMETER RulesChatIndexImageTag
-    Tag of the rules-chat-index image the index job runs. Default: the same tag as the site image.
+    Tag of the rules-chat-index image the index job runs. Only the deploy workflow builds and pushes this image.
 
 .PARAMETER RulesChatAlertEmail
     Optional email address for index job failure and staleness alerts.
@@ -87,8 +87,8 @@ param(
     [Parameter(Mandatory = $false)]
     [string]$RulesChatContentBranch = 'main',
 
-    [Parameter(Mandatory = $false)]
-    [string]$RulesChatIndexImageTag = '',
+    [Parameter(Mandatory = $true)]
+    [string]$RulesChatIndexImageTag,
 
     [Parameter(Mandatory = $false)]
     [string]$RulesChatAlertEmail = '',
@@ -456,9 +456,7 @@ $azArgs += '--parameters', "rulesChatFoundryName=$RulesChatFoundryName"
 $azArgs += '--parameters', "rulesChatContainerAppsEnvironmentName=$RulesChatContainerAppsEnvironmentName"
 $azArgs += '--parameters', "rulesChatIndexJobName=$RulesChatIndexJobName"
 $azArgs += '--parameters', "rulesChatContentBranch=$RulesChatContentBranch"
-if ($RulesChatIndexImageTag) {
-    $azArgs += '--parameters', "rulesChatIndexImageTag=$RulesChatIndexImageTag"
-}
+$azArgs += '--parameters', "rulesChatIndexImageTag=$RulesChatIndexImageTag"
 if ($RulesChatAlertEmail) {
     $azArgs += '--parameters', "rulesChatAlertEmail=$RulesChatAlertEmail"
 }
diff --git a/infra/main.bicep b/infra/main.bicep
index 2f6866800..ad35c703f 100644
--- a/infra/main.bicep
+++ b/infra/main.bicep
@@ -117,8 +117,8 @@ param rulesChatContainerAppsEnvironmentName string
 @description('Name of the Container Apps job that indexes the rules (32 characters at most)')
 param rulesChatIndexJobName string
 
-@description('Tag of the index job image. A tag unique to each build, so the job never runs an older image cached under the same tag.')
-param rulesChatIndexImageTag string = imageTag
+@description('Tag of the index job image. A tag unique to each build, so the job never runs an older image cached under the same tag. Only the deploy workflow builds and pushes this image.')
+param rulesChatIndexImageTag string
 
 @description('SSW.Rules.Content branch the index job reads, matching the content this environment shows')
 param rulesChatContentBranch string = 'main'