Fix/verbose appconfig logging (#8)

* fix: enable verbose logging for Azure App Configuration

- Add logx.Init(verbose) in CLI root initialization
- Ensures Azure App Configuration debug logs are shown with --verbose flag
- Fixes issue where appconfig.go debug logs were suppressed
- No functional changes, only improves logging visibility

* fix: use APP_CONFIG_LABEL environment variable for Azure App Config

- Fix Azure App Configuration provider to read APP_CONFIG_LABEL env var
- Previously was using environment name instead of actual label
- This fixes the issue where service-specific keys weren't being fetched
- Now properly fetches keys with the correct label (e.g., 'dev')

* improve: better error handling and simplified label logic

- Use --env flag directly as Azure App Config label (dev/staging/prod)
- Remove dependency on APP_CONFIG_LABEL environment variable
- Add user-friendly warning messages for malformed JSON in Azure App Config
- Provide specific guidance on common JSON issues (missing commas, duplicate keys)
- This makes the tool easier to use and provides better error messages

* fix: update ACR validation test to work with Azure App Config changes

- Add APP_CONFIG_SKIP=true to disable Azure App Configuration in test
- Clean up environment variables properly in test
- Fix linting issues (errcheck and line length)
- Ensures test validates missing variables correctly without interference from global config

* fix: make malformed JSON in Azure App Config fail deployment

CRITICAL FIX: Malformed JSON in Azure App Configuration now fails deployment instead of just warning.

- Change all JSON parsing errors from WARN to ERROR with proper error returns
- Malformed JSON prevents NEXT_PUBLIC_* variables from being passed as build args
- This ensures applications get required environment variables or deployment fails
- Add fmt import and fix linting issues with error return value checks
- Provides clear error messages about JSON issues (missing commas, duplicate keys)

This prevents silent failures where apps deploy without required environment variables.

* fix: add auto-detection of IMAGE_NAME and IMAGE_TAG to WebApp command

- WebApp command now auto-detects IMAGE_NAME and IMAGE_TAG from CI environment like ACI and ACR commands
- Uses same detectImageNameFromCI() and detectImageTagFromCI() functions
- Ensures consistency across all deployment commands (ACR, ACI, WebApp)
- Fixes issue where WebApp required manual IMAGE_NAME/IMAGE_TAG while ACI worked automatically
- Now WebApp deployment works seamlessly in CI/CD pipelines without manual variable setup

* fix: WebApp now sets environment variables from Azure App Configuration

- WebApp deployment now calls setWebAppSettings() to configure app settings
- Uses 'az webapp config appsettings set' to pass environment variables to container
- Filters out internal azctl variables (ACR_*, RESOURCE_GROUP, etc.)
- Only passes application-specific variables like NEXT_PUBLIC_* to container
- Fixes issue where WebApp containers couldn't access Azure App Config variables
- Now WebApp behavior matches ACI in terms of environment variable injection

* fix: WebApp now correctly filters environment variables from Azure App Configuration

- WebApp now only sets application-specific environment variables (like ACI does)
- Added isApplicationVariable() function to filter variables by prefixes:
  * NEXT_PUBLIC_* (React/Next.js public variables)
  * SUPABASE_*, SOLANA_*, AZURE_OPENAI_*, OPENAI_*, LOGFLARE_*, FIREBASE_*, SAGEMAKER_*
  * PORT, NODE_ENV, ENVIRONMENT
- Filters out infrastructure variables (PATH, USER, SHELL, etc.) that shouldn't go to containers
- Now sets only 10 relevant application settings instead of 69+ system variables
- Matches ACI behavior where only service-specific variables are passed to containers
- Fixes issue where WebApp was trying to set system environment variables

* fix: remove unnecessary quotes from WebApp environment variables

- Modified escapeShellValue() to not wrap values in quotes
- Azure CLI webapp config appsettings set handles values properly without quotes
- Environment variables now set without literal quote characters
- Fixes issue where URLs like 'https://example.com' had quotes in the actual value

* fix: WebApp now uses proper ACR authentication like ACI

- Fixed container image format: chiswarm/swarm-nextjs-fe -> chiswarm.azurecr.io/swarm-nextjs-fe
- Added setWebAppRegistryCredentials() function to set Docker registry credentials
- Maps ACR credentials to WebApp Docker registry settings:
  * DOCKER_REGISTRY_SERVER_URL=https://chiswarm.azurecr.io
  * DOCKER_REGISTRY_SERVER_USERNAME=chiswarm (from ACR_USERNAME)
  * DOCKER_REGISTRY_SERVER_PASSWORD=<ACR_PASSWORD>
- Now WebApp authentication matches ACI authentication exactly
- Fixes 'pull access denied' errors in WebApp deployment center logs

* fix: clean up formatting in webapp.go

- Remove trailing whitespace
- Fix line ending formatting

Author: furiatona

internal/cli/integration_test.go

@@ -10,14 +10,19 @@ import (
 )
 
 func TestACRCommandValidation(t *testing.T) {
-	// Clean environment
+	// Clean environment and disable Azure App Configuration
 	defer func() {
-		for _, v := range []string{"ACR_REGISTRY", "ACR_RESOURCE_GROUP", "IMAGE_NAME", "IMAGE_TAG"} {
+		envVars := []string{"ACR_REGISTRY", "ACR_RESOURCE_GROUP", "IMAGE_NAME", "IMAGE_TAG", "APP_CONFIG_NAME", "APP_CONFIG"}
+		for _, v := range envVars {
 			//nolint:errcheck // os.Unsetenv rarely fails in test cleanup
 			os.Unsetenv(v)
 		}
 	}()
 
+	// Disable Azure App Configuration for this test
+	//nolint:errcheck // os.Setenv rarely fails in test setup
+	os.Setenv("APP_CONFIG_SKIP", "true")
+
 	// Test missing variables
 	err := Execute(context.Background(), []string{"acr"})
 	if err == nil {

internal/cli/root.go

@@ -6,6 +6,7 @@ import (
 
 	"github.com/furiatona/azctl/internal/config"
 	"github.com/furiatona/azctl/internal/logging"
+	"github.com/furiatona/azctl/internal/logx"
 
 	"github.com/spf13/cobra"
 )
@@ -61,6 +62,9 @@ func Execute(ctx context.Context, args []string) error {
 			return fmt.Errorf("failed to initialize logging: %w", err)
 		}
 
+		// Initialize logx package with verbose flag for Azure App Configuration logging
+		logx.Init(verbose)
+
 		envfile, _ := cmd.Flags().GetString("envfile")
 		env, _ := cmd.Flags().GetString("env")
 

internal/cli/webapp.go

@@ -43,6 +43,22 @@ func newWebAppCmd() *cobra.Command {
 				return fmt.Errorf("environment required for webapp deployment (--env dev|staging|prod)")
 			}
 
+			// Auto-detect IMAGE_NAME and IMAGE_TAG in CI if not set
+			if isCIEnvironment() {
+				if cfg.Get("IMAGE_NAME") == "" {
+					if detectedImageName := detectImageNameFromCI(); detectedImageName != "" {
+						cfg.Set("IMAGE_NAME", detectedImageName)
+						logging.Debugf("Auto-detected IMAGE_NAME from CI: %s", detectedImageName)
+					}
+				}
+				if cfg.Get("IMAGE_TAG") == "" {
+					if detectedImageTag := detectImageTagFromCI(); detectedImageTag != "" {
+						cfg.Set("IMAGE_TAG", detectedImageTag)
+						logging.Debugf("Auto-detected IMAGE_TAG from CI: %s", detectedImageTag)
+					}
+				}
+			}
+
 			// Apply flag overrides
 			if resourceGroup == "" {
 				resourceGroup = cfg.Get("RESOURCE_GROUP")
@@ -158,9 +174,10 @@ func updateWebApp(ctx context.Context, resourceGroup, webAppName string, cfg *co
 		return fmt.Errorf("missing required variables: ACR_REGISTRY, IMAGE_NAME, IMAGE_TAG")
 	}
 
-	fullImageName := fmt.Sprintf("%s/%s:%s", registry, imageName, imageTag)
-	registryUrl := fmt.Sprintf("https://%s", registry)
+	fullImageName := fmt.Sprintf("%s.azurecr.io/%s:%s", registry, imageName, imageTag)
+	registryUrl := fmt.Sprintf("https://%s.azurecr.io", registry)
 
+	// Set container image
 	args := []string{
 		"webapp", "config", "container", "set",
 		"--name", webAppName,
@@ -169,7 +186,194 @@ func updateWebApp(ctx context.Context, resourceGroup, webAppName string, cfg *co
 		"--container-registry-url", registryUrl,
 	}
 	if err := runx.AZ(ctx, args...); err != nil {
-		return fmt.Errorf("failed to update webapp: %w", err)
+		return fmt.Errorf("failed to update webapp container: %w", err)
+	}
+
+	// Set Docker registry credentials
+	if err := setWebAppRegistryCredentials(ctx, resourceGroup, webAppName, cfg); err != nil {
+		return fmt.Errorf("failed to set webapp registry credentials: %w", err)
+	}
+
+	// Set application settings (environment variables) from config
+	if err := setWebAppSettings(ctx, resourceGroup, webAppName, cfg); err != nil {
+		return fmt.Errorf("failed to set webapp settings: %w", err)
+	}
+
+	return nil
+}
+
+// setWebAppSettings sets application settings (environment variables) for the WebApp
+func setWebAppSettings(ctx context.Context, resourceGroup, webAppName string, cfg *config.Config) error {
+	// Collect only application-specific environment variables (like ACI does)
+	allVars := cfg.GetAll()
+	settings := make([]string, 0, len(allVars))
+	for key, value := range allVars {
+		// Skip internal azctl variables that shouldn't be passed to the container
+		if isInternalVariable(key) {
+			continue
+		}
+
+		// Skip variables with very long values that might cause Azure CLI issues
+		if len(value) > 4000 {
+			logging.Debugf("Skipping variable '%s' - value too long (%d chars)", key, len(value))
+			continue
+		}
+
+		// Only include variables that are application-specific (similar to ACI environmentVariables)
+		if !isApplicationVariable(key) {
+			logging.Debugf("Skipping infrastructure variable '%s'", key)
+			continue
+		}
+
+		// Escape the value for shell safety (but don't add quotes)
+		escapedValue := escapeShellValue(value)
+		settings = append(settings, fmt.Sprintf("%s=%s", key, escapedValue))
+		logging.Debugf("Including application setting: %s", key)
+	}
+
+	if len(settings) == 0 {
+		logging.Debugf("No application settings to configure for WebApp '%s'", webAppName)
+		return nil
+	}
+
+	// Set application settings using az CLI - do it in batches to avoid command line length limits
+	const batchSize = 20
+	for i := 0; i < len(settings); i += batchSize {
+		end := i + batchSize
+		if end > len(settings) {
+			end = len(settings)
+		}
+
+		batch := settings[i:end]
+		args := []string{
+			"webapp", "config", "appsettings", "set",
+			"--name", webAppName,
+			"--resource-group", resourceGroup,
+			"--settings",
+		}
+		args = append(args, batch...)
+
+		logging.Debugf("Setting batch %d/%d (%d settings) for WebApp '%s'",
+			(i/batchSize)+1, (len(settings)+batchSize-1)/batchSize, len(batch), webAppName)
+
+		if err := runx.AZ(ctx, args...); err != nil {
+			return fmt.Errorf("failed to set application settings batch %d: %w", (i/batchSize)+1, err)
+		}
+	}
+
+	logging.Infof("✅ Set %d application settings for WebApp '%s'", len(settings), webAppName)
+	return nil
+}
+
+// setWebAppRegistryCredentials sets Docker registry credentials for the WebApp
+func setWebAppRegistryCredentials(ctx context.Context, resourceGroup, webAppName string, cfg *config.Config) error {
+	acrRegistry := cfg.Get("ACR_REGISTRY")
+	acrUsername := cfg.Get("ACR_USERNAME")
+	acrPassword := cfg.Get("ACR_PASSWORD")
+
+	if acrRegistry == "" || acrUsername == "" || acrPassword == "" {
+		return fmt.Errorf("missing required ACR credentials: ACR_REGISTRY, ACR_USERNAME, ACR_PASSWORD")
+	}
+
+	// Set Docker registry server URL (should include .azurecr.io suffix)
+	registryUrl := fmt.Sprintf("https://%s.azurecr.io", acrRegistry)
+	registrySettings := []string{
+		fmt.Sprintf("DOCKER_REGISTRY_SERVER_URL=%s", registryUrl),
+		fmt.Sprintf("DOCKER_REGISTRY_SERVER_USERNAME=%s", acrUsername),
+		fmt.Sprintf("DOCKER_REGISTRY_SERVER_PASSWORD=%s", acrPassword),
+	}
+
+	// Set Docker registry credentials using az CLI
+	args := []string{
+		"webapp", "config", "appsettings", "set",
+		"--name", webAppName,
+		"--resource-group", resourceGroup,
+		"--settings",
+	}
+	args = append(args, registrySettings...)
+
+	logging.Debugf("Setting Docker registry credentials for WebApp '%s': URL=%s, Username=%s",
+		webAppName, registryUrl, acrUsername)
+
+	if err := runx.AZ(ctx, args...); err != nil {
+		return fmt.Errorf("failed to set Docker registry credentials: %w", err)
 	}
+
+	logging.Infof("✅ Set Docker registry credentials for WebApp '%s'", webAppName)
 	return nil
 }
+
+// escapeShellValue escapes a value for safe use in shell commands
+func escapeShellValue(value string) string {
+	// Replace quotes with escaped quotes and handle special characters
+	// Don't wrap in quotes as Azure CLI handles the values properly
+	escaped := strings.ReplaceAll(value, `"`, `\"`)
+	return escaped
+}
+
+// isInternalVariable checks if a variable is internal to azctl and shouldn't be passed to containers
+func isInternalVariable(key string) bool {
+	internalVars := []string{
+		"ACR_REGISTRY",
+		"ACR_RESOURCE_GROUP",
+		"ACR_USERNAME",
+		"ACR_PASSWORD",
+		"RESOURCE_GROUP",
+		"IMAGE_NAME",
+		"IMAGE_TAG",
+		"WEBAPP_NAME",
+		"APP_SERVICE_PLAN",
+		"LOG_STORAGE_ACCOUNT",
+		"LOG_STORAGE_KEY",
+		"LOG_STORAGE_NAME",
+		"FLUENTBIT_CONFIG",
+		"APP_CONFIG_NAME",
+		"APP_CONFIG_LABEL",
+		"APP_CONFIG_SKIP",
+	}
+
+	for _, internal := range internalVars {
+		if key == internal {
+			return true
+		}
+	}
+	return false
+}
+
+// isApplicationVariable checks if a variable should be passed to the application container
+// This matches the environmentVariables in the ACI template
+func isApplicationVariable(key string) bool {
+	// Application-specific prefixes and variables (like in ACI environmentVariables)
+	applicationPrefixes := []string{
+		"NEXT_PUBLIC_",
+		"SUPABASE_",
+		"SOLANA_",
+		"AZURE_OPENAI_",
+		"OPENAI_",
+		"LOGFLARE_",
+		"FIREBASE_",
+		"SAGEMAKER_",
+	}
+
+	// Check prefixes
+	for _, prefix := range applicationPrefixes {
+		if strings.HasPrefix(key, prefix) {
+			return true
+		}
+	}
+
+	// Specific application variables (not prefixed)
+	applicationVars := []string{
+		"PORT",
+		"NODE_ENV",
+		"ENVIRONMENT",
+	}
+
+	for _, appVar := range applicationVars {
+		if key == appVar {
+			return true
+		}
+	}
+
+	return false
+}

internal/config/appconfig.go

@@ -54,8 +54,11 @@ func fetchAzureAppConfigWithImage(ctx context.Context, name, label, imageName st
 					}
 				}
 			} else {
-				logx.Infof("[DEBUG] Failed to parse global-configurations JSON: %v", err)
-				logx.Infof("[DEBUG] Raw JSON value: %s", globalKV.Value)
+				//nolint:errcheck // Error logging for debugging
+				logx.Errorf("[ERROR] Failed to parse global-configurations JSON: %v", err)
+				//nolint:errcheck // Error logging for debugging
+				logx.Errorf("[ERROR] Raw JSON value: %s", globalKV.Value)
+				return nil, fmt.Errorf("malformed JSON in Azure App Configuration global-configurations key: %w", err)
 			}
 		}
 	} else {
@@ -83,8 +86,11 @@ func fetchAzureAppConfigWithImage(ctx context.Context, name, label, imageName st
 							}
 						}
 					} else {
-						logx.Infof("[DEBUG] Failed to parse global-configurations JSON (no label): %v", err)
-						logx.Infof("[DEBUG] Raw JSON value (no label): %s", globalKVNoLabel.Value)
+						//nolint:errcheck // Error logging for debugging
+						logx.Errorf("[ERROR] Failed to parse global-configurations JSON (no label): %v", err)
+						//nolint:errcheck // Error logging for debugging
+						logx.Errorf("[ERROR] Raw JSON value (no label): %s", globalKVNoLabel.Value)
+						return nil, fmt.Errorf("malformed JSON in Azure App Configuration global-configurations key (no label): %w", err)
 					}
 				}
 			} else {
@@ -118,8 +124,15 @@ func fetchAzureAppConfigWithImage(ctx context.Context, name, label, imageName st
 						}
 					}
 				} else {
-					logx.Infof("[DEBUG] Failed to parse service-specific JSON: %v", err)
-					logx.Infof("[DEBUG] Raw service JSON value: %s", serviceKV.Value)
+					//nolint:errcheck // Error logging for debugging
+					logx.Errorf("[ERROR] Failed to parse service-specific JSON for key '%s': %v", imageName, err)
+					//nolint:errcheck // Error logging for debugging
+					logx.Errorf("[ERROR] Please check your Azure App Configuration JSON format for key '%s'", imageName)
+					//nolint:errcheck // Error logging for debugging
+					logx.Errorf("[ERROR] Common issues: missing commas, duplicate keys, or invalid JSON syntax")
+					//nolint:errcheck // Error logging for debugging
+					logx.Errorf("[ERROR] Raw service JSON value: %s", serviceKV.Value)
+					return nil, fmt.Errorf("malformed JSON in Azure App Configuration key '%s': %w", imageName, err)
 				}
 			}
 		} else {
@@ -146,8 +159,15 @@ func fetchAzureAppConfigWithImage(ctx context.Context, name, label, imageName st
 								}
 							}
 						} else {
-							logx.Infof("[DEBUG] Failed to parse service-specific JSON (no label): %v", err)
-							logx.Infof("[DEBUG] Raw service JSON value (no label): %s", serviceKVNoLabel.Value)
+							//nolint:errcheck // Error logging for debugging
+							logx.Errorf("[ERROR] Failed to parse service-specific JSON (no label) for key '%s': %v", imageName, err)
+							//nolint:errcheck // Error logging for debugging
+							logx.Errorf("[ERROR] Please check your Azure App Configuration JSON format for key '%s'", imageName)
+							//nolint:errcheck // Error logging for debugging
+							logx.Errorf("[ERROR] Common issues: missing commas, duplicate keys, or invalid JSON syntax")
+							//nolint:errcheck // Error logging for debugging
+							logx.Errorf("[ERROR] Raw service JSON value (no label): %s", serviceKVNoLabel.Value)
+							return nil, fmt.Errorf("malformed JSON in Azure App Configuration key '%s': %w", imageName, err)
 						}
 					}
 				} else {

internal/config/config.go

@@ -226,7 +226,10 @@ func (p *AzureAppConfigProvider) Load(ctx context.Context) (map[string]string, e
 	// Determine service name for Azure App Config
 	serviceName := p.determineServiceName()
 
-	return fetchAzureAppConfigWithImage(ctx, name, p.env, serviceName)
+	// Use environment name as label (dev, staging, prod)
+	label := p.env
+
+	return fetchAzureAppConfigWithImage(ctx, name, label, serviceName)
 }
 
 // determineServiceName determines the service name for Azure App Config