Fix sample issues from review and migrate azlocal to lstk

[paolosalvatori]

Motivation

Andrew Thomas's review of the samples surfaced several issues:

1. function-app-storage-http/dotnet builds a net10.0 app, but its Terraform config provisioned a .NET 9 host (dotnet_version default 9.0, allowlist 6.0/8.0/9.0) — the worker crashes with an opaque dotnet exited with code 150 / app-launch-failed.
2. terraform/README.md claimed deploy.sh auto-detects LocalStack and switches to tflocal/azlocal — the script has no such logic.
3. scripts/README.md listed a funclocal prerequisite (archived tool) that no script uses.
4. A deployment README had a copy-pasted cd pointing at a different sample's directory.
5. call-web-app.sh curls the container's internal Docker IP with no timeout, stalling for minutes on macOS.

As agreed, we move forward to .NET 10 (not back to 9) by bumping the azurerm provider, and we take the opportunity to complete the planned migration from the deprecated azlocal CLI to the new lstk CLI plus a full broken-link audit of every README. The emulator already supports .NET 10 (10.0.2 in supported_platforms.json since #6191).

The first CI round then surfaced two emulator gaps with azurerm 4.81 and two unrelated breakages, all fixed in the second commit (see "azurerm 4.81 CI fallout" below).

Fixes SMF-826

Changes

.NET 10 / azurerm alignment

• function-app-storage-http/dotnet: dotnet_version default + allowlist now include 10.0 (variables.tf), terraform.tfvars bumped to 10.0 (it overrode the default), bicep runtimeVersion '9.0' → '10.0', stale net9.0 tokens in sample.sln refreshed, stale RUNTIME_VERSION="9" snippet in the scripts README corrected.
• azurerm provider bumped to =4.81.0 in 9 of 11 samples (was a mix of 4.14/4.25/4.60; dotnet_version = "10.0" requires ≥ 4.54.0). Two samples stay on =4.60.0 with bump-back comments because the current emulator cannot serve them on 4.81 (see below).

azurerm 4.81 CI fallout (second commit)

• aci-blob-storage/terraform: deploy.sh pre-creates the RG and imports it, so the config tags forced an in-place RG update that azurerm 4.81 issues as PATCH — not implemented by the emulator (501). Fixed with lifecycle { ignore_changes = [tags] } on the imported RG.
• web-app-sql-database/terraform: azurerm > 4.60 strictly parses the sid returned for Key Vault certificates; the emulator returns the certificate id there (expected NestedItemType to be secrets, got certificates). Pinned to =4.60.0 (bisected live: 4.60 passes, 4.80 fails); emulator parity fix prepared separately.
• web-app-cosmosdb-mongodb-api/terraform: with 4.81 the Cosmos Mongo collection create/get requests hang in the emulator (never complete; 30-minute create timeout kills the job). Pinned to =4.60.0; emulator fix tracked separately.
• function-app-front-door/scripts (unrelated to azurerm): az afd moved from azure-cli core into the cdn extension, which removed the flattened --match-variable/--action-name/--rule-sets arguments. Rewrote the three az afd rule create calls to structured --conditions/--actions shorthand and the route attachment to --formatted-rule-sets (each verified against the emulator).
• run-samples.sh: lstk az <cmd> proxy calls fail on CI runners with "Azure CLI integration is not set up". lstk az start-interception works, so login/account/cleanup commands now use the plain az CLI once interception is active.
• Renamed deprecated enable_rbac_authorization → rbac_authorization_enabled where the pinned provider supports it.

azlocal → lstk migration (205 references, 52 files)

• azlocal start-interception / stop-interception → lstk az start-interception / stop-interception.
• README prerequisites, install blocks (pip install azlocal → brew/npm), and prose rewritten for lstk; lstk CLI docs + GitHub repo links added to every sample's References/Related Documentation section (created where missing).
• CI: new "Install lstk CLI" step (npm install -g @localstack/lstk); azlocal dropped from requirements-runtime.txt, azlocal/terraform-local dropped from pyproject.toml.

Documentation now matches reality

• Removed fictional tflocal/azlocal auto-detection claims, funclocal prerequisites/steps, fake AZ="azlocal" dispatch snippets (servicebus), and fabricated script output.
• Converted function-app-storage-http/dotnet/scripts/deploy.sh from func azure functionapp publish (with NuGet proxy workaround) to dotnet publish + zip + az functionapp deploy, matching the sample's terraform/bicep paths; the now-unused Azure Functions Core Tools requirement is dropped from run-samples.sh and CI. All three deploy scripts of the sample now guard dotnet publish failures and recreate the zip (no stale-build deploys).

Robustness & link audit

• --max-time 10 added to all 44 curls in call/test scripts (the repo's existing timeout pattern) — fixes the macOS stall on unreachable container IPs.
• Fixed the copy-pasted cd (terraform README pointed at function-app-managed-identity), two pre-rename function-app-and-storage paths, three stale cd python lines, 17 broken relative links, 5 dead external links (moved Microsoft Learn pages, old LocalStack auth-token URL), HubSpot tracking params in 31 files, and assorted typos/duplicate headings.

Tests

• Full 31-job sample matrix is green on the head commit (two jobs needed a rerun for environmental flakes: an emulator boot timeout on the runner, and a transient role-definition lookup that passes consistently otherwise).
• Every round-1 CI failure was reproduced and re-verified locally against localstack/localstack-azure:latest before fixing (RG PATCH 501, KV cert sid parse, Cosmos Mongo hang, az afd argument errors); the azurerm cutoff for the KV cert issue was bisected live (4.60 PASS / 4.80 FAIL).
• terraform init && terraform validate passes for all samples on their pinned providers; bash -n passes for every modified script; dotnet build -c Release of the .NET 10 sample succeeds locally (SDK 10.0.103).
• All relative markdown links resolve; every replaced external URL returns 2xx; zero azlocal/tflocal/funclocal references remain (one intentional explanatory CI comment).
• The rewritten front-door az afd commands and the new lstk flow were exercised locally against the emulator; pre-commit (zizmor, gitleaks) passes.

Related

• Review feedback from Andrew Thomas (Slack)
• .NET 10 emulator support: localstack-pro-azure #6191
• Emulator follow-ups to lift the two =4.60.0 pins: Key Vault certificate kid/sid parity (fix branch fix/keyvault-certificate-sid-kid-parity) and the Cosmos Mongo collection create/get hang — Linear issues to be filed.

🤖 Generated with Claude Code

[DrisDary]

Thank Paolo, LGTM