agentops-accelerator 0.3.0__py3-none-any.whl

agentops/templates/workflows/agentops-deploy-dev-azd.yml

@@ -0,0 +1,166 @@
+# AgentOps - Deploy to DEV with azd
+#
+# agentops:deploy-mode=azd
+#
+# Runs on push to develop. Delegates infrastructure and app deployment to
+# Azure Developer CLI. AgentOps only gates quality; azd owns provision,
+# deployment packaging, and any hooks declared in azure.yaml.
+#
+# Generated by `agentops workflow generate --deploy-mode azd`.
+
+name: AgentOps Deploy (DEV)
+
+on:
+  push:
+    branches:
+      - develop
+  workflow_dispatch:
+    inputs:
+      config:
+        description: "Path to agentops.yaml (defaults to ./agentops.yaml at repo root)"
+        required: false
+        default: "agentops.yaml"
+      provision:
+        description: "Run azd provision before deploy"
+        required: false
+        type: boolean
+        default: true
+
+permissions:
+  contents: read
+  id-token: write
+  packages: write
+
+concurrency:
+  group: agentops-deploy-dev-${{ github.ref }}
+  cancel-in-progress: false
+
+jobs:
+  provision:
+    name: azd provision (DEV)
+    runs-on: ubuntu-latest
+    environment: dev
+    timeout-minutes: 45
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v6
+
+      - name: Set up azd
+        uses: Azure/setup-azd@v2
+
+      - name: Azure login (OIDC)
+        uses: azure/login@v3
+        with:
+          client-id: ${{ vars.AZURE_CLIENT_ID }}
+          tenant-id: ${{ vars.AZURE_TENANT_ID }}
+          subscription-id: ${{ vars.AZURE_SUBSCRIPTION_ID }}
+
+      - name: Prepare azd environment
+        env:
+          AZURE_ENV_NAME: ${{ vars.AZURE_ENV_NAME || 'dev' }}
+          AZURE_LOCATION: ${{ vars.AZURE_LOCATION }}
+        run: |
+          test -f azure.yaml || {
+            echo "::error file=azure.yaml::No azure.yaml found. Ask your coding agent to generate a zero-trust azd deployment, then re-run this workflow."
+            exit 1
+          }
+          azd env new "$AZURE_ENV_NAME" --no-prompt --subscription "${{ vars.AZURE_SUBSCRIPTION_ID }}" ${AZURE_LOCATION:+--location "$AZURE_LOCATION"} \
+            || azd env select "$AZURE_ENV_NAME"
+          azd env set AZURE_SUBSCRIPTION_ID "${{ vars.AZURE_SUBSCRIPTION_ID }}"
+          if [ -n "$AZURE_LOCATION" ]; then
+            azd env set AZURE_LOCATION "$AZURE_LOCATION"
+          fi
+
+      - name: Run azd provision
+        env:
+          AZURE_ENV_NAME: ${{ vars.AZURE_ENV_NAME || 'dev' }}
+        run: |
+          SHOULD_PROVISION="true"
+          if [ "${{ github.event_name }}" = "workflow_dispatch" ]; then
+            SHOULD_PROVISION="${{ inputs.provision }}"
+          fi
+          if [ "$SHOULD_PROVISION" = "true" ]; then
+__AILZ_PREFLIGHT_COMMAND__
+            azd provision --no-prompt
+          else
+            echo "Skipping azd provision by workflow input."
+          fi
+
+  eval:
+    name: Eval (gate)
+    needs: provision
+    runs-on: ubuntu-latest
+    timeout-minutes: 30
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v6
+
+      - name: Azure login (OIDC)
+        uses: azure/login@v3
+        with:
+          client-id: ${{ vars.AZURE_CLIENT_ID }}
+          tenant-id: ${{ vars.AZURE_TENANT_ID }}
+          subscription-id: ${{ vars.AZURE_SUBSCRIPTION_ID }}
+
+      - name: Set up Python
+        uses: actions/setup-python@v6
+        with:
+          python-version: "3.11"
+
+      - name: Install uv
+        uses: astral-sh/setup-uv@v7
+        with:
+          enable-cache: false
+
+      - name: Install AgentOps Toolkit
+        run: |
+          uv pip install --system "agentops-accelerator[foundry] @ git+https://github.com/Azure/agentops.git@main"
+
+__EVAL_STEPS__
+
+      - name: Upload AgentOps results
+        if: always()
+        uses: actions/upload-artifact@v7
+        with:
+          name: agentops-dev-results
+          path: |
+            __EVAL_ARTIFACT_PATHS__
+          if-no-files-found: warn
+
+  deploy:
+    name: azd deploy (DEV)
+    needs: eval
+    runs-on: ubuntu-latest
+    environment: dev
+    timeout-minutes: 45
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v6
+
+      - name: Set up azd
+        uses: Azure/setup-azd@v2
+
+      - name: Azure login (OIDC)
+        uses: azure/login@v3
+        with:
+          client-id: ${{ vars.AZURE_CLIENT_ID }}
+          tenant-id: ${{ vars.AZURE_TENANT_ID }}
+          subscription-id: ${{ vars.AZURE_SUBSCRIPTION_ID }}
+
+      - name: Run azd deploy
+        env:
+          AZURE_ENV_NAME: ${{ vars.AZURE_ENV_NAME || 'dev' }}
+          AZURE_LOCATION: ${{ vars.AZURE_LOCATION }}
+        run: |
+          test -f azure.yaml || {
+            echo "::error file=azure.yaml::No azure.yaml found. Ask your coding agent to generate a zero-trust azd deployment, then re-run this workflow."
+            exit 1
+          }
+          azd env new "$AZURE_ENV_NAME" --no-prompt --subscription "${{ vars.AZURE_SUBSCRIPTION_ID }}" ${AZURE_LOCATION:+--location "$AZURE_LOCATION"} \
+            || azd env select "$AZURE_ENV_NAME"
+          azd env set AZURE_SUBSCRIPTION_ID "${{ vars.AZURE_SUBSCRIPTION_ID }}"
+          if [ -n "$AZURE_LOCATION" ]; then
+            azd env set AZURE_LOCATION "$AZURE_LOCATION"
+          fi
+          azd env refresh "$AZURE_ENV_NAME" --no-prompt
+          azd deploy --no-prompt

agentops/templates/workflows/agentops-deploy-dev.yml

@@ -0,0 +1,187 @@
+# AgentOps — Deploy to DEV
+#
+# Triggers on every push to `develop`. Runs the AgentOps eval as a
+# quality gate, then builds and deploys to the `dev` GitHub Environment.
+#
+# To finish wiring this for your project:
+#   1. Configure the `dev` GitHub Environment (Settings -> Environments).
+#      Add any environment-specific variables/secrets there.
+#   2. Fill in the `Build` and `Deploy` steps below to match your stack
+#      (see commented examples).
+#   3. Make sure the AgentOps eval passes locally first:
+#         agentops eval run
+#
+# Generated by `agentops workflow generate`.
+
+name: AgentOps Deploy (DEV)
+
+on:
+  push:
+    branches:
+      - develop
+  workflow_dispatch:
+    inputs:
+      config:
+        description: "Path to agentops.yaml (defaults to ./agentops.yaml at repo root)"
+        required: false
+        default: "agentops.yaml"
+
+permissions:
+  contents: read
+  id-token: write
+  packages: write
+
+concurrency:
+  group: agentops-deploy-dev-${{ github.ref }}
+  cancel-in-progress: false
+
+jobs:
+  eval:
+    name: Eval (gate)
+    runs-on: ubuntu-latest
+    timeout-minutes: 30
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v6
+
+      - name: Azure login (OIDC)
+        uses: azure/login@v3
+        with:
+          client-id: ${{ vars.AZURE_CLIENT_ID }}
+          tenant-id: ${{ vars.AZURE_TENANT_ID }}
+          subscription-id: ${{ vars.AZURE_SUBSCRIPTION_ID }}
+
+      - name: Set up Python
+        uses: actions/setup-python@v6
+        with:
+          python-version: "3.11"
+
+      # uv is ~5-10x faster than pip on cold installs; the AgentOps stack
+      # (azure-* + opentelemetry-instrumentation-*) pulls dozens of small
+      # wheels so the speed-up is very visible in CI.
+      - name: Install uv
+        uses: astral-sh/setup-uv@v7
+        with:
+          enable-cache: false
+
+      - name: Install AgentOps Toolkit
+        run: |
+          # NOTE: pinned to GitHub main until the next package release includes this flow.
+          # Switch to `uv pip install --system "agentops-accelerator[foundry]"` after release.
+          uv pip install --system "agentops-accelerator[foundry] @ git+https://github.com/Azure/agentops.git@main"
+
+__EVAL_STEPS__
+
+      - name: Upload AgentOps results
+        if: always()
+        uses: actions/upload-artifact@v7
+        with:
+          name: agentops-dev-results
+          path: |
+            __EVAL_ARTIFACT_PATHS__
+          if-no-files-found: warn
+
+      - name: Step summary
+        if: always()
+        run: |
+          {
+            echo "## AgentOps Eval (DEV gate)"
+            echo
+            if [ -f .agentops/results/latest/report.md ]; then
+              cat .agentops/results/latest/report.md
+            fi
+          } >> "$GITHUB_STEP_SUMMARY"
+
+  build:
+    name: Build
+    needs: eval
+    runs-on: ubuntu-latest
+    timeout-minutes: 30
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v6
+
+      - name: Azure login (OIDC)
+        uses: azure/login@v3
+        with:
+          client-id: ${{ vars.AZURE_CLIENT_ID }}
+          tenant-id: ${{ vars.AZURE_TENANT_ID }}
+          subscription-id: ${{ vars.AZURE_SUBSCRIPTION_ID }}
+
+      # ---------------------------------------------------------------
+      # TODO: replace this placeholder with your build step.
+      #
+      # Examples (uncomment one):
+      #
+      # # Python wheel:
+      # - uses: actions/setup-python@v6
+      #   with: { python-version: "3.11" }
+      # - run: pip install build && python -m build
+      #
+      # # Docker image to ACR (server-side build):
+      # - run: |
+      #     az acr build \
+      #       --registry "${{ vars.ACR_NAME }}" \
+      #       --image "myapp:${{ github.sha }}" \
+      #       .
+      #
+      # # azd package:
+      # - uses: Azure/setup-azd@v2
+      # - run: azd package --no-prompt
+      # ---------------------------------------------------------------
+      - name: Build (placeholder)
+        run: |
+          echo "TODO: replace this step with your build."
+          echo "See the commented examples in this workflow."
+
+  deploy:
+    name: Deploy to DEV
+    needs: build
+    runs-on: ubuntu-latest
+    environment: dev
+    timeout-minutes: 30
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v6
+
+      - name: Azure login (OIDC)
+        uses: azure/login@v3
+        with:
+          client-id: ${{ vars.AZURE_CLIENT_ID }}
+          tenant-id: ${{ vars.AZURE_TENANT_ID }}
+          subscription-id: ${{ vars.AZURE_SUBSCRIPTION_ID }}
+
+      # ---------------------------------------------------------------
+      # TODO: replace this placeholder with your deploy step.
+      #
+      # Examples (uncomment one):
+      #
+      # # Azure Container Apps:
+      # - run: |
+      #     az containerapp update \
+      #       --name "${{ vars.ACA_APP_NAME }}" \
+      #       --resource-group "${{ vars.AZURE_RESOURCE_GROUP }}" \
+      #       --image "${{ vars.ACR_NAME }}.azurecr.io/myapp:${{ github.sha }}"
+      #
+      # # Azure App Service:
+      # - uses: azure/webapps-deploy@v3
+      #   with:
+      #     app-name: ${{ vars.WEBAPP_NAME }}
+      #     package: ./dist
+      #
+      # # Foundry prompt agent:
+      # # Prefer regenerating this workflow with:
+      # #   agentops workflow generate --deploy-mode prompt-agent --force
+      # # That path creates a candidate Foundry version from prompt_file,
+      # # evaluates that exact version, then records it as deployed.
+      #
+      # # azd up / deploy:
+      # - uses: Azure/setup-azd@v2
+      # - run: azd deploy --no-prompt
+      #   env:
+      #     AZURE_ENV_NAME: dev
+      # ---------------------------------------------------------------
+      - name: Deploy (placeholder)
+        run: |
+          echo "TODO: replace this step with your deploy."
+          echo "Target environment: dev"

agentops/templates/workflows/agentops-deploy-prod-azd.yml

@@ -0,0 +1,183 @@
+# AgentOps - Deploy to PRODUCTION with azd
+#
+# agentops:deploy-mode=azd
+#
+# Runs on push to main. Production should have required reviewers in the
+# GitHub Environment. azd provision is opt-in for production; app deploy
+# only runs after the AgentOps safety/quality gate passes.
+#
+# Generated by `agentops workflow generate --deploy-mode azd`.
+
+name: AgentOps Deploy (PROD)
+
+on:
+  push:
+    branches:
+      - main
+  workflow_dispatch:
+    inputs:
+      config:
+        description: "Path to agentops.yaml (defaults to ./agentops.yaml at repo root)"
+        required: false
+        default: "agentops.yaml"
+      provision:
+        description: "Run azd provision before deploy"
+        required: false
+        type: boolean
+        default: false
+
+permissions:
+  contents: read
+  id-token: write
+  packages: write
+
+concurrency:
+  group: agentops-deploy-prod-${{ github.ref }}
+  cancel-in-progress: false
+
+jobs:
+  provision:
+    name: azd environment (PROD)
+    runs-on: ubuntu-latest
+    environment: production
+    timeout-minutes: 45
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v6
+      - name: Set up azd
+        uses: Azure/setup-azd@v2
+      - name: Azure login (OIDC)
+        uses: azure/login@v3
+        with:
+          client-id: ${{ vars.AZURE_CLIENT_ID }}
+          tenant-id: ${{ vars.AZURE_TENANT_ID }}
+          subscription-id: ${{ vars.AZURE_SUBSCRIPTION_ID }}
+      - name: Prepare azd environment
+        env:
+          AZURE_ENV_NAME: ${{ vars.AZURE_ENV_NAME || 'production' }}
+          AZURE_LOCATION: ${{ vars.AZURE_LOCATION }}
+        run: |
+          test -f azure.yaml || {
+            echo "::error file=azure.yaml::No azure.yaml found. Ask your coding agent to generate a zero-trust azd deployment, then re-run this workflow."
+            exit 1
+          }
+          azd env new "$AZURE_ENV_NAME" --no-prompt --subscription "${{ vars.AZURE_SUBSCRIPTION_ID }}" ${AZURE_LOCATION:+--location "$AZURE_LOCATION"} \
+            || azd env select "$AZURE_ENV_NAME"
+          azd env set AZURE_SUBSCRIPTION_ID "${{ vars.AZURE_SUBSCRIPTION_ID }}"
+          if [ -n "$AZURE_LOCATION" ]; then
+            azd env set AZURE_LOCATION "$AZURE_LOCATION"
+          fi
+      - name: Run azd provision when requested
+        env:
+          AZURE_ENV_NAME: ${{ vars.AZURE_ENV_NAME || 'production' }}
+        run: |
+          SHOULD_PROVISION="false"
+          if [ "${{ github.event_name }}" = "workflow_dispatch" ]; then
+            SHOULD_PROVISION="${{ inputs.provision }}"
+          fi
+          if [ "$SHOULD_PROVISION" = "true" ]; then
+__AILZ_PREFLIGHT_COMMAND__
+            azd provision --no-prompt
+          else
+            echo "Skipping azd provision for PROD. Use workflow_dispatch with provision=true for reviewed infra changes."
+          fi
+
+  safety-eval:
+    name: Safety eval (gate)
+    needs: provision
+    runs-on: ubuntu-latest
+    timeout-minutes: 30
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v6
+      - name: Azure login (OIDC)
+        uses: azure/login@v3
+        with:
+          client-id: ${{ vars.AZURE_CLIENT_ID }}
+          tenant-id: ${{ vars.AZURE_TENANT_ID }}
+          subscription-id: ${{ vars.AZURE_SUBSCRIPTION_ID }}
+      - name: Set up Python
+        uses: actions/setup-python@v6
+        with:
+          python-version: "3.11"
+      - name: Install uv
+        uses: astral-sh/setup-uv@v7
+        with:
+          enable-cache: false
+
+      - name: Install AgentOps Toolkit
+        run: uv pip install --system "agentops-accelerator[foundry,agent] @ git+https://github.com/Azure/agentops.git@main"
+__EVAL_STEPS__
+      - name: Generate release evidence
+        if: always()
+        env:
+          AZURE_AI_FOUNDRY_PROJECT_ENDPOINT: ${{ vars.AZURE_AI_FOUNDRY_PROJECT_ENDPOINT }}
+          AZURE_OPENAI_ENDPOINT: ${{ vars.AZURE_OPENAI_ENDPOINT }}
+          AZURE_OPENAI_DEPLOYMENT: ${{ vars.AZURE_OPENAI_DEPLOYMENT }}
+          APPLICATIONINSIGHTS_CONNECTION_STRING: ${{ secrets.APPLICATIONINSIGHTS_CONNECTION_STRING || vars.APPLICATIONINSIGHTS_CONNECTION_STRING }}
+        run: |
+          agentops doctor --workspace . --out .agentops/agent/report.md \
+            --severity-fail critical --evidence-pack
+      - name: Upload AgentOps results
+        if: always()
+        uses: actions/upload-artifact@v7
+        with:
+          name: agentops-prod-results
+          path: |
+            __EVAL_ARTIFACT_PATHS__
+            .agentops/agent/report.md
+            .agentops/release/latest/evidence.json
+            .agentops/release/latest/evidence.md
+          if-no-files-found: warn
+
+      - name: Step summary
+        if: always()
+        run: |
+          {
+            echo "## AgentOps Safety Eval (PROD gate)"
+            echo
+            if [ -f .agentops/results/latest/report.md ]; then
+              cat .agentops/results/latest/report.md
+            fi
+            if [ -f .agentops/release/latest/evidence.md ]; then
+              echo
+              echo "---"
+              echo
+              cat .agentops/release/latest/evidence.md
+            fi
+          } >> "$GITHUB_STEP_SUMMARY"
+
+  deploy:
+    name: azd deploy (PROD)
+    needs: safety-eval
+    runs-on: ubuntu-latest
+    environment: production
+    timeout-minutes: 45
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v6
+      - name: Set up azd
+        uses: Azure/setup-azd@v2
+      - name: Azure login (OIDC)
+        uses: azure/login@v3
+        with:
+          client-id: ${{ vars.AZURE_CLIENT_ID }}
+          tenant-id: ${{ vars.AZURE_TENANT_ID }}
+          subscription-id: ${{ vars.AZURE_SUBSCRIPTION_ID }}
+      - name: Run azd deploy
+        env:
+          AZURE_ENV_NAME: ${{ vars.AZURE_ENV_NAME || 'production' }}
+          AZURE_LOCATION: ${{ vars.AZURE_LOCATION }}
+        run: |
+          test -f azure.yaml || {
+            echo "::error file=azure.yaml::No azure.yaml found. Ask your coding agent to generate a zero-trust azd deployment, then re-run this workflow."
+            exit 1
+          }
+          azd env new "$AZURE_ENV_NAME" --no-prompt --subscription "${{ vars.AZURE_SUBSCRIPTION_ID }}" ${AZURE_LOCATION:+--location "$AZURE_LOCATION"} \
+            || azd env select "$AZURE_ENV_NAME"
+          azd env set AZURE_SUBSCRIPTION_ID "${{ vars.AZURE_SUBSCRIPTION_ID }}"
+          if [ -n "$AZURE_LOCATION" ]; then
+            azd env set AZURE_LOCATION "$AZURE_LOCATION"
+          fi
+          azd env refresh "$AZURE_ENV_NAME" --no-prompt
+          azd deploy --no-prompt

agentops/templates/workflows/agentops-deploy-prod.yml

@@ -0,0 +1,171 @@
+# AgentOps — Deploy to PRODUCTION
+#
+# Triggers on every push to `main` (typically the merge of a release
+# branch). Runs a safety/quality eval, builds, and deploys to the
+# `production` GitHub Environment.
+#
+# IMPORTANT: configure the `production` environment with REQUIRED
+# REVIEWERS so a deploy to prod always needs human approval:
+#   Repo Settings -> Environments -> production
+#     -> Required reviewers (add at least one)
+#     -> (optional) Wait timer
+#     -> (optional) Deployment branches: only `main`
+#
+# To finish wiring this for your project:
+#   1. Configure the `production` environment as described above.
+#   2. Optionally point the eval step at a hardened safety bundle
+#      (e.g. `.agentops/runs/safety.yaml`).
+#   3. Fill in the `Build` and `Deploy` steps below to match your stack
+#      (see commented examples in agentops-deploy-dev.yml).
+#
+# Generated by `agentops workflow generate`.
+
+name: AgentOps Deploy (PROD)
+
+on:
+  push:
+    branches:
+      - main
+  workflow_dispatch:
+    inputs:
+      config:
+        description: "Path to agentops.yaml (defaults to ./agentops.yaml at repo root)"
+        required: false
+        default: "agentops.yaml"
+
+permissions:
+  contents: read
+  id-token: write
+  packages: write
+
+concurrency:
+  group: agentops-deploy-prod-${{ github.ref }}
+  cancel-in-progress: false
+
+jobs:
+  safety-eval:
+    name: Safety eval (gate)
+    runs-on: ubuntu-latest
+    timeout-minutes: 30
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v6
+
+      - name: Azure login (OIDC)
+        uses: azure/login@v3
+        with:
+          client-id: ${{ vars.AZURE_CLIENT_ID }}
+          tenant-id: ${{ vars.AZURE_TENANT_ID }}
+          subscription-id: ${{ vars.AZURE_SUBSCRIPTION_ID }}
+
+      - name: Set up Python
+        uses: actions/setup-python@v6
+        with:
+          python-version: "3.11"
+
+      # uv is ~5-10x faster than pip on cold installs; the AgentOps stack
+      # (azure-* + opentelemetry-instrumentation-*) pulls dozens of small
+      # wheels so the speed-up is very visible in CI.
+      - name: Install uv
+        uses: astral-sh/setup-uv@v7
+        with:
+          enable-cache: false
+
+      - name: Install AgentOps Toolkit
+        run: |
+          # NOTE: pinned to GitHub main until the next package release includes this flow.
+          # Switch to `uv pip install --system "agentops-accelerator[foundry,agent]"` after release.
+          uv pip install --system "agentops-accelerator[foundry,agent] @ git+https://github.com/Azure/agentops.git@main"
+
+__EVAL_STEPS__
+
+      - name: Generate release evidence
+        if: always()
+        env:
+          AZURE_AI_FOUNDRY_PROJECT_ENDPOINT: ${{ vars.AZURE_AI_FOUNDRY_PROJECT_ENDPOINT }}
+          AZURE_OPENAI_ENDPOINT: ${{ vars.AZURE_OPENAI_ENDPOINT }}
+          AZURE_OPENAI_DEPLOYMENT: ${{ vars.AZURE_OPENAI_DEPLOYMENT }}
+          APPLICATIONINSIGHTS_CONNECTION_STRING: ${{ secrets.APPLICATIONINSIGHTS_CONNECTION_STRING || vars.APPLICATIONINSIGHTS_CONNECTION_STRING }}
+        run: |
+          agentops doctor --workspace . --out .agentops/agent/report.md \
+            --severity-fail critical --evidence-pack
+
+      - name: Upload AgentOps results
+        if: always()
+        uses: actions/upload-artifact@v7
+        with:
+          name: agentops-prod-results
+          path: |
+            __EVAL_ARTIFACT_PATHS__
+            .agentops/agent/report.md
+            .agentops/release/latest/evidence.json
+            .agentops/release/latest/evidence.md
+          if-no-files-found: warn
+
+      - name: Step summary
+        if: always()
+        run: |
+          {
+            echo "## AgentOps Safety Eval (PROD gate)"
+            echo
+            if [ -f .agentops/results/latest/report.md ]; then
+              cat .agentops/results/latest/report.md
+            fi
+            if [ -f .agentops/release/latest/evidence.md ]; then
+              echo
+              echo "---"
+              echo
+              cat .agentops/release/latest/evidence.md
+            fi
+          } >> "$GITHUB_STEP_SUMMARY"
+
+  build:
+    name: Build
+    needs: safety-eval
+    runs-on: ubuntu-latest
+    timeout-minutes: 30
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v6
+
+      - name: Azure login (OIDC)
+        uses: azure/login@v3
+        with:
+          client-id: ${{ vars.AZURE_CLIENT_ID }}
+          tenant-id: ${{ vars.AZURE_TENANT_ID }}
+          subscription-id: ${{ vars.AZURE_SUBSCRIPTION_ID }}
+
+      # ---------------------------------------------------------------
+      # TODO: replace this placeholder with your build step.
+      # See agentops-deploy-dev.yml for example snippets.
+      # ---------------------------------------------------------------
+      - name: Build (placeholder)
+        run: |
+          echo "TODO: replace this step with your build."
+
+  deploy:
+    name: Deploy to PROD
+    needs: build
+    runs-on: ubuntu-latest
+    environment: production
+    timeout-minutes: 30
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v6
+
+      - name: Azure login (OIDC)
+        uses: azure/login@v3
+        with:
+          client-id: ${{ vars.AZURE_CLIENT_ID }}
+          tenant-id: ${{ vars.AZURE_TENANT_ID }}
+          subscription-id: ${{ vars.AZURE_SUBSCRIPTION_ID }}
+
+      # ---------------------------------------------------------------
+      # TODO: replace this placeholder with your deploy step.
+      # See agentops-deploy-dev.yml for example snippets (ACA, App
+      # Service, Foundry hosted agent, azd deploy).
+      # ---------------------------------------------------------------
+      - name: Deploy (placeholder)
+        run: |
+          echo "TODO: replace this step with your deploy."
+          echo "Target environment: production"