Enforce Bicep Linting Rules via bicepconfig.json in CI

The bicepconfig.json file controls analyzer rules, linter severity levels, module aliases, and experimental features for the Bicep compiler. Internally the compiler reads this file from the template's directory upward to the workspace root, merges settings, and applies them during compilation. Rules such as no-unused-params, no-hardcoded-env-urls, adminusername-should-not-be-literal, and max-asserts are evaluated and reported as warnings or errors depending on the configured level.

In production CI, elevating security-relevant rules to error level turns the build step into a policy gate: for example, setting no-hardcoded-env-urls to error blocks templates that pin to sovereign cloud endpoints, and adminusername-should-not-be-literal to error prevents credential leakage. Teams also use the analyzer to enforce naming conventions and required tags via custom rules, and to disable noisy rules that conflict with organizational patterns. Combined with az bicep build --diagnostics-format sarif, results integrate natively with GitHub Code Scanning and Azure DevOps.

Security-wise, the linter catches a surprising number of real vulnerabilities: hardcoded secrets, public blob access defaults, and missing TLS minimum versions. Performance impact is minimal, though very large templates with many modules may see compile time grow by a few hundred milliseconds. A common pitfall is that bicepconfig.json is not inherited across module boundaries when modules are pulled from a registry, so a module authored elsewhere may pass its own lint but violate consumer policies; mitigate by running lint in the module's own pipeline. Another pitfall is that experimentalFeatures must be enabled explicitly and can change between compiler versions.

> System.Execute()

cat > bicepconfig.json <<'EOF'
{
  "analyzers": {
    "core": {
      "enabled": true,
      "rules": {
        "no-hardcoded-env-urls": { "level": "error" },
        "adminusername-should-not-be-literal": { "level": "error" },
        "no-unused-params": { "level": "warning" },
        "max-outputs": { "level": "warning" }
      }
    }
  }
}
EOF
az bicep build --file ./infra/main.bicep --diagnostics-format sarif > lint.sarif

> Architecture & Security Context

Verified for Valters IT Hub. When deploying this configuration in a production homelab or enterprise environment, ensure that you monitor system resources and implement strict access controls. Administrator privileges are required.

ID: VALTERSIT-5111E4552935