/azure-app-onboard-prereq

Dependency compatibility checks for Azure. Part of the deployability check.

EOL / Unsupported Runtimes

Quick test: ONE config value change, no import changes? → ❌ FAIL. Otherwise → 🔶.

Ecosystem-era check (Python): ALL pinned deps pre-2018, no Python 3.10+ wheels → ❌ FAIL. Signals: flask_script, werkzeug<1.0, itsdangerous<1.0, imports from werkzeug.contrib.* / flask.ext.*.

EOL / Unmaintained Frameworks

Archived / Abandoned Repositories

Remediation scope: Fixing all blockers requires major upgrade OR >5 files → 🔶 Major Migration.

Intentionally Vulnerable Applications

Detect via code structure first, metadata second. These apps are designed to be exploited — vulnerability IS the product.

Code signals (check first):

• Directory vulnerabilities/ with subdirs like sqli/, xss/, csrf/, fi/ (file inclusion)
• Security-level config toggling vulnerability severity (default_security_level, security.level, difficulty)
• Source files with intentionally unsanitized $_GET/$_POST/$_REQUEST passed to SQL queries, shell commands (exec, shell_exec, system ), or eval/include -- that are systematic across 3+ files (not a single bug)
• hackable//exploit/ directories, or files with names like command_injection.php, brute_force.php

Metadata signals (secondary check):

• Project/package description or repo About containing: "deliberately vulnerable", "intentionally insecure", "vulnerable by design", "security training", "penetration testing", "do not deploy to production"
• README/License warning against internet-facing deployment

Verdict: ≥2 code signals OR 1 code + 1 metadata → 🛑 HALT. Single metadata only → ⚠️ WARN (could be a disclosure).

⛔ 🛑 HALT is a verdict, not an exit. On 🛑 HALT your NEXT action MUST be the Step-4 write — persist all 3 artifacts (prereq-output.json, context.json, readiness-report.md) with overallHealth: "blocked" via the create tool, then read them back, BEFORE printing any halt summary to the user. A halt message with no prereq-output.json on disk is a failure — the deterministic blocked verdict must be persisted first, because the halt message can end the turn.

Non-Azure Cloud SDK Dependencies

Functional cloud SDK deps → 🔶 blockers; classification and observability carve-out in cloud-sdk-migration.md. The redirect gate (SKILL.md Step 2) and the deploy-blocking stop (SKILL.md Step 8 Row 2) own all routing — no routeToSkill decision happens here.

Platform-Specific Dependencies

Hardcoded Localhost URLs

Exclude: database connection strings, dev-only files, test files.

Dockerfile Analysis

Also check docker-compose.yml command: overrides.

Native Module Detection

Static lockfile analysis only.

⛔ Lockfile grep is the ONLY valid evidence. Do NOT set hasNativeModules from package name alone. prebuild-install without node-gyp = prebuilt → hasNativeModules: false. Key: bcrypt ✅ native, bcryptjs ❌ JS. psycopg2 ✅, psycopg2-binary ❌. sharp v0.33+ ❌ prebuilt. canvas ✅ always. No lockfile → "unknown", ⚠️ WARN.

When hasNativeModules: true: f1Viable: false, f1BlockReason: "native modules ({signal})".

F1 Viability — Beyond Native Modules

When f1Viable: false: prepare selects B1 (~$13/mo) minimum.

First-Run Initialization

Detect init steps needed before first HTTP request — run automatically in dev but cause 500s on Azure.

Seed/bootstrap: Flask @app.cli.command('deploy') → flask deploy. Django fixtures/ → manage.py loaddata. Seed commands: required: false.

Migration framework + migrations/ dir → ⚠️ WARN, write to prereq-output.json.initCommands[] (schema in prereq-schemas.ts). ORM without migrations/ dir → ✅ PASS. Prepare prepends required initCommands to deployStrategy.startupCommand; scaffold encodes in appCommandLine. Migrations are idempotent — safe on every cold start.

Database & Storage