Repository navigation
Add recipe: business users reviewing Foundry Skills from Teams - #96
Open
Linda Li (lindazqli) wants to merge 7 commits into
Open
Linda Li (lindazqli) wants to merge 7 commits into
Linda Li (lindazqli) wants to merge 7 commits into
Conversation
Notebook walks through a Foundry hosted agent published to Teams that lets business users review, propose, and approve Foundry Skill pull requests using a per-user OAuth2 Foundry toolbox against GitHub's catalog MCP server, so every git action is attributed to the actual person rather than a shared bot token. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
Adds main.py, toolbox.yaml, agent.yaml, requirements.txt, .env.example, setup.ps1, and setup.sh as %%writefile cells, so running the notebook materializes the whole sample on disk and setup.ps1/setup.sh take a reader from a fresh clone of nothing to a sideloadable/publishable Teams app in one command (azd ai connection create -> azd ai toolbox create -> azd deploy -> azd ai agent pack/publish). This keeps the recipe fully self-contained instead of pointing at a separate samples-repo PR. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
…ved change into a live Foundry Skill) Merging a skill's PR only updates the file in GitHub; it never made the change live in Foundry. Adds a second, explicit agent capability -- publish_skill_to_foundry -- that reads the merged SKILL.md and calls project.beta.skills.create_from_package(...) under the hosted agent's own managed identity, triggered on-demand by a plain-language request like 'make the refund-policy skill live'. Updates the embedded main.py, agent.yaml (also drops a stale GITHUB_TOKEN env var left over from the pre-toolbox design, and adds the missing TOOLBOX_NAME), and requirements.txt cells accordingly, plus a short explanatory cell on the merge-vs-publish distinction. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
…ion conflict Live-tested against a real Foundry project and found create_from_package doesn't exist in azure-ai-projects; switched to the confirmed-working beta.skills.create(name, inline_content=SkillInlineContent(...)). Also discovered azure-ai-projects>=2.7.0 (required for the Skills API) conflicts with agent-framework-foundry's own <2.7.0 pin, so publish_skill_worker.py now runs in a second, isolated venv built by the Dockerfile and is called via subprocess instead of being imported directly. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
…p in isolated skills-venv, wrong RBAC role documented for publish_skill_to_foundry Live end-to-end test (deployed hosted agent, real GitHub PR merge, real Foundry publish) failed twice before passing: 1. ImportError: aiohttp package is not installed -- azure-identity's async credential transport needs aiohttp even though nothing imports it directly. 2. HttpResponseError: identity lacks Microsoft.CognitiveServices/accounts/AIServices/agents/write -- the README's suggested 'Foundry User'/'Azure AI User' role does NOT grant this permission (verified via role definition inspection: it has no relevant dataAction). The correct role is 'Foundry Project Manager' (has the Microsoft.CognitiveServices/* dataAction). Confirmed live: merged a real PR, invoked the deployed agent, and verified the resulting skill actually exists in Foundry via project.beta.skills.get(). Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
…ests with cross-identity verification
… branch protection as the real merge gate
Contributor
🔍 PreviewBuild and checks passed, but a live preview wasn't auto-deployed because Linda Li (@lindazqli) isn't a member of |
This branch has not been deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What
New Forgebook recipe (
otebooks/skill-review-teams-bot.ipynb) plus a
egistry.yaml entry.
It walks through a Foundry hosted agent, published to Microsoft Teams, that lets business users review, propose, and approve Foundry Skill pull requests using their own GitHub identity, not a shared bot token. Covers: why a shared-token bot breaks GitHub's self-approval/required-review protections, how a per-user OAuth2 catalog-MCP toolbox connection solves it, why the merge gate had to move to instructions + branch protection, and lessons from making the agent speak like a business user.
The notebook is fully self-contained: it embeds the complete runnable sample as %%writefile\ code cells (\main.py, \ oolbox.yaml, \�gent.yaml,
equirements.txt, .env.example, \setup.ps1, \setup.sh), so running it materializes the whole sample on disk. \setup.ps1/\setup.sh\ wrap \�zd ai connection create\ -> \�zd ai toolbox create\ -> \�zd deploy\ -> \�zd ai agent pack/\publish, so a reader goes from running the notebook to a sideloadable or shareable Teams app in one script -- no separate samples-repo checkout needed.
Checklist
px tsx validate-registry.ts\ passes (19 notebooks, no warnings)
Co-authored-by: Copilot App 223556219+Copilot@users.noreply.github.com