Consolidate airlock storage architecture and implement metadata-based management#4853

Draft

marrobi wants to merge 45 commits intomicrosoft:mainfrom

marrobi:copilot/redesign-airlock-storage-accounts

Commits on Feb 5, 2026

Initial plan
Copilot
committed
Add comprehensive design document for airlock storage consolidation

Copilot
and
marrobi
committed
Update design to use metadata-based stage management instead of data copying

Copilot
and
marrobi
committed
Add metadata-based blob operations and update constants for consolidated storage

Copilot
and
marrobi
committed
Add implementation status document and update CHANGELOG

Copilot
and
marrobi
committed
Complete Terraform infrastructure consolidation for core and workspace airlock storage

Copilot
and
marrobi
committed
Add storage helper functions and update implementation status

Copilot
and
marrobi
committed
New approach: Use blob index tags for EventGrid filtering while keeping container names unchanged

Copilot
and
marrobi
committed
Implement unified EventGrid subscriptions with metadata-based routing

Copilot
and
marrobi
committed
Integrate metadata-based routing in airlock processor with feature flag support

Copilot
and
marrobi
committed
Add comprehensive EventGrid unified subscription documentation

Copilot
and
marrobi
committed
Add ABAC conditions to restrict API access based on container metadata stages

Copilot
and
marrobi
committed
Fix stage name consistency: use hyphenated 'in-progress' throughout

Copilot
and
marrobi
committed
Final consistency fixes for stage naming throughout codebase

Copilot
and
marrobi
committed
Add security analysis revealing need for separate public/private storage accounts

Copilot
and
marrobi
committed
Updated plan: Use ABAC with private endpoint filtering to maintain network isolation

Copilot
and
marrobi
committed
Implement revised architecture: keep public accounts separate, use ABAC with PE filtering

Copilot
and
marrobi
committed
Plan: Consolidate to 1 core account using ABAC to allow public/private access per stage

Copilot
and
marrobi
committed
Final architecture: 1 core account via App Gateway + 1 per workspace for isolation

Copilot
and
marrobi
committed
Implement 1 core account with App Gateway routing and PE-based ABAC

Copilot
and
marrobi
committed
Add final architecture documentation and update CHANGELOG

Copilot
and
marrobi
committed
Fix ABAC condition logic and align API access with ABAC permissions

Copilot
and
marrobi
committed
Add clarifying comments to ABAC conditions explaining the Boolean logic

Copilot
and
marrobi
committed
Add comprehensive analysis of copy operations and workspace_id ABAC options

Copilot
and
marrobi
committed
Implement Option B: Global workspace storage with workspace_id ABAC filtering

Copilot
and
marrobi
committed
Update airlock documentation for Option B architecture and confirm UI compatibility

Copilot
and
marrobi
committed
Add e2e tests for Option B workspace isolation and metadata-based transitions

Copilot
and
marrobi
committed
Remove all "Option B" references from codebase and documentation

Copilot
and
marrobi
committed
Remove unimplemented App Gateway PE and correct documentation

Copilot
and
marrobi
committed
Remove all Option A/B references and clarify 2 storage accounts

Copilot
and
marrobi
committed
Remove unused legacy storage account name variables

Copilot
and
marrobi
committed
remove comments, update docs
marrobi
committed
Update app gawateway configuration
marrobi
committed
linting
marrobi
committed

Commits on Feb 6, 2026

Commits on Feb 11, 2026